June 2010 - Freeradius-Users - lists.freeradius.org

Re: Enabling / disabling active directory users
by Iain Grant 17 Jun '10

17 Jun '10

Correct me if I am wrong, that would mean i'd have to use ldap as my connection between the freeradius server and the Win2008 RC2 AD instead of my existing ntlm_auth connection ? Iain ______________________________________________________ SCRI, Invergowrie, Dundee, DD2 5DA. The Scottish Crop Research Institute is a charitable company limited by guarantee. Registered in Scotland No: SC 29367. Recognised by the Inland Revenue as a Scottish Charity No: SC 006662. DISCLAIMER: This email is from the Scottish Crop Research Institute, but the views expressed by the sender are not necessarily the views of SCRI and its subsidiaries. This email and any files transmitted with it are confidential to the intended recipient at the e-mail address to which it has been addressed. It may not be disclosed or used by any other than that addressee. If you are not the intended recipient you are requested to preserve this confidentiality and you must not use, disclose, copy, print or rely on this e-mail in any way. Please notify postmaster(a)scri.ac.uk quoting the name of the sender and delete the email from your system. Although SCRI has taken reasonable precautions to ensure no viruses are present in this email, neither the Institute nor the sender accepts any responsibility for any viruses, and it is your responsibility to scan the email and the attachments (if any). ______________________________________________________

3 2

Marking proxy servers as zombie - odd behaviour
by John Horne 17 Jun '10

17 Jun '10

Hello, We have 3 backend servers which are used in a client-balance mode from our local proxy server. We are running FR 2.1.10 (from git), but have seen the following behaviour when we were running 2.1.7 and 2.1.9 for a short time. Our logs are showing that FR marks the backend servers as zombie every few minutes. Not all of them at once, just one or maybe two, and then one will be marked as alive and another marked as zombie, and so on. As far as we can see there is no general network problem, and neither the radius nor backend servers are under any particular load. Running tcpdump for a short time seemed to show that something odd was going on (I have included the actual date/time of the packets, but removed the contents. I think the packet header lines should show what I mean): ============================================================= 2010-06-17 10:47:35 IP 141.163.66.101.1812 > 141.163.195.250.1814: RADIUS, Access Accept (2), id: 0xdd length: 278 2010-06-17 10:47:46 IP 141.163.66.101.1812 > 141.163.195.250.1814: RADIUS, Access Reject (3), id: 0xb2 length: 20 ============================================================= At this time, our radius log showed: ============================================================= Thu Jun 17 10:47:35 2010 : Auth: Login OK: [xxxxxx] (from client GRN-DVB-WISM-1 port 29 cli 7C-6D-62-63-03-8D) Thu Jun 17 10:47:46 2010 : Proxy: Marking home server 141.163.66.101 port 1812 as zombie (it looks like it is dead). Thu Jun 17 10:47:46 2010 : Proxy: Received response to status check 10959 (1 in current sequence) ============================================================= So what is being seen is that backend server 141.163.66.101 has sent an accept accept packet (to the local proxy server 195.250) and the log shows a user as having authenticated. About 10 seconds later, the server is marked as zombie, but tcpdump shows that a packet (access reject - we have status-server set up with an invalid userid, so the reject is correct) is received from that server. So I think the question is why did FR think the server was zombie when it had received an access-accept just a few seconds before? Why does it think it looks like it is dead? The tcpdump shows no other packets being sent to/from the server for FR to think that. And why is it that when FR thinks the backend server is dead it receives a status check reply at the same time? Did it send the status check query (and if so why didn't tcpdump show it?) but for whatever reason immediately decide that the server had not replied? Maybe I am wrong but I would not have expected FR to even consider the backend server as zombie/dead given that it had received a packet from it 10 seconds before. Thanks, John. -- John Horne, University of Plymouth, UK Tel: +44 (0)1752 587287 Fax: +44 (0)1752 587001

5 10

dot1x with samba workstation accounts
by Jens Weibler 17 Jun '10

17 Jun '10

Hello, I'm trying to authenticate my windows boxes with dot1x against freeradius. Everything is working fine if I'm using a normal user. But I want to use the samba workstation accounts from ldap. The problem: mschap blocks accounts which have only the W-sambaAcctFlag set: > info: [mschap] SMB-Account-Ctrl says that the account is disabled, or > is not a normal account. Shouldn't it be possible to use workstation accounts? My temporary solution is to exclude querying sambaAcctFlag. No real solution if you want to lock out really expired or disabled accounts :( -- Jens Weibler

2 4

Calling-Station-Id and Called-Station-Id values
by Omer Faruk Sen 17 Jun '10

17 Jun '10

Hi, How can I make Calling-Station-Id and Called-Station-Id to be see in accounting if one of them is empty in detail log file. What I mean if one of the field (Calling-Station-Id or Called-Station-Id ) doesn't supplied by NAS I want it to be seen like : Calling-Station-Id = "xxxx" Called-Station-Id = "" or Calling-Station-Id = "" Called-Station-Id = "yyyy" Right now if one of the attribute is empty it is now shown in detail log file like: User-Name = "10.241.1.14" Called-Station-Id = "xxxxx" Acct-Status-Type = Stop or User-Name = "10.241.1.14" Calling-Station-Id = "yyyyyyyyy" Acct-Status-Type = Stop Regards.

2 3

Having trouble compiling freeradius 2.1.9 on ubuntu 10.04
by Bassem Nagi 17 Jun '10

17 Jun '10

Hi, Iam having trouble compiling freeradius version 2.1.9 on ubuntu 10.04 when i try to start the server i get an error stating radiusd: error while loading shared libraries: libfreeradius-radius-2.1.9.so: cannot open shared object file: No such file or directory Any help would be appreciated. Thanx

8 12

freeradius 2.1.9 crashes working in proxy mode
by Fred MAISON 17 Jun '10

17 Jun '10

Hi all, I also encountered same crashed while testing Normal/backup proxy feature. I'm going to try if I am able to rebuild 2.1.10 using git, following git build infos available en freeradius wiki, and I will report if this also solves my problem. Freeradius 2.1.9 build from sources under CentOS5.5 x86_64. Best regards Fred MAISON

1 0

Enabling / disabling active directory users
by Iain Grant 17 Jun '10

17 Jun '10

We have on site a Windows 2008 RC2 domain controller ( 64-bit ) which I have a linux based freeradius server hanging from. My question is, other than changing the users file on the freeradius server, is there another way of disabling a user from authentication through the radius server but still allow them access via the active directory route. So for example, a user can log in quite happily on site using their windows machine. If they go offsite and try authentication via the radius server they will not be allowed. Does active directory have a flag or something that can be set against the user account to deny access via a radius link. Thanks Iain ______________________________________________________ SCRI, Invergowrie, Dundee, DD2 5DA. The Scottish Crop Research Institute is a charitable company limited by guarantee. Registered in Scotland No: SC 29367. Recognised by the Inland Revenue as a Scottish Charity No: SC 006662. DISCLAIMER: This email is from the Scottish Crop Research Institute, but the views expressed by the sender are not necessarily the views of SCRI and its subsidiaries. This email and any files transmitted with it are confidential to the intended recipient at the e-mail address to which it has been addressed. It may not be disclosed or used by any other than that addressee. If you are not the intended recipient you are requested to preserve this confidentiality and you must not use, disclose, copy, print or rely on this e-mail in any way. Please notify postmaster(a)scri.ac.uk quoting the name of the sender and delete the email from your system. Although SCRI has taken reasonable precautions to ensure no viruses are present in this email, neither the Institute nor the sender accepts any responsibility for any viruses, and it is your responsibility to scan the email and the attachments (if any). ______________________________________________________

3 2

Check line and radgroupcheck evaluation question
by Matt Hite 16 Jun '10

16 Jun '10

Hello, Are check lines in the "users" file short-circuit "AND" evaluated from left to right? Extrapolating this presumption out to radgroupcheck when using a MySQL database, are the check items evaluated simply in order of column id value (ie. the order they are returned from the SELECT)? authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" Just trying to wrap my head around how one might do something useful with radgroupcheck. I guess you are supposed to be able to match some condition on the row whose group matches with the lowest column ID and then subsequent rows that also have the same matching group (with higher column ID's) can be used to set attributes or look for further requisite conditions? I am actually wanting to reject connections when groups of users come in on the wrong huntgroup. I've seen significant discussion and confusion in the mailing list archives in regards to this. Most of the time I see people say "use radcheck to reject." I did spot a gem from Ivan Kalik, though, which led me down this path. >>However, the issue remains: >>I do not want the user to be rejected per se. I only want the user to be >>rejected if her own huntgroup as stored in radgroupcheck is different from >>he huntgroup of the Called-Station-Id in the radhuntgroup table. The goal >>is to prevent a user to login to a hotspot router, that does not belong to >>the huntgroup the user belongs to. > >Hm, and what do you think: > >>> Huntgroup-Name != "Test", Auth-Type := Reject > >that does? As a joke, put them in radgroupcheck and see if it does >*exactly* what you have described. Thanks for your help, -M

2 2

freeradius 2.1.9 crashes working in proxy mode
by JOE 16 Jun '10

16 Jun '10

Hi all Actually I have two servers (in cluster mode with heartbeat) working each one with two radius services, one proxy and one radius as follow: Server1: .- freeradius server 2.1.9 : listening on port 1645 , working in proxy mode with load balance configuration and point to local radius and Server2 radius - freeradius server 2.1.9: listening on port 1812, working in radius mode. Server2: .- freeradius server 2.1.9 : listening on port 1645 , working in proxy mode with load balance and point to local radius an Server1 radius - freeradius server 2.1.9: listening on port 1812, working in radius mode. Load Balance works fine but when I force shutdown of one of local radius servers the proxy crashes with a segmentation. you have any idea what is happening? Regards

3 3

Segment Fault
by David Peterson 16 Jun '10

16 Jun '10

[61490.335957] freeradius[6212]: segfault at 6c ip 00a51951 sp bfd33070 error 4 in libfreeradius-radius-2.1.8.so[a3d000+1e000] [61510.556054] freeradius[6214]: segfault at 6c ip 00a97951 sp bfab1530 error 4 in libfreeradius-radius-2.1.8.so[a83000+1e000] [62031.935361] hrtimer: interrupt took 36340206 ns Anyone know what causes this sort of crash? It happens when I access EAP. If 2.1.9 fixes this, can someone point me to an Ubuntu repository that has it available. David Peterson

2 1