September 2010 - Freeradius-Users - lists.freeradius.org

Certificates
by freeradius＠corwyn.net 16 Sep '10

16 Sep '10

I'm tinkering with my VPN setup using FreeRadius and AD, and getting "Not possible to verify the identity of the server". Some googling shows that message can be related to certificates. Some digging through the FreeRadius docs came up with: If FreeRADIUS was configured to use OpenSSL, then simply starting the server in root in debugging mode should also create test certificates, i.e.: Does this mean that, presuming I never did create certificates, that freeradius could function differently in debug mode than when running not in debug mode? Rick Rick Steeves http://www.sinister.net In reality nothing is more damaging to the adventurous spirit within a man than a secure future - Alexander Supertramp

2 1

freeradius, samba, AD peap/mschap-v2 redundancy and Certificate
by schilling 15 Sep '10

15 Sep '10

Hi, We are thinking of authenticate users via 802.1x/mschapv2 with freeradius, samba and Active Directory. Is the following a good redundancy design? If not, which one is better? radius1 1.1.1.1, radius2 2.2.2.2 Active Directory Domain Controllers 3.3.3.3 4.4.4.4 put 1.1.1.1 and 2.2.2.2 as primary/secondary radius server list in switch/AP/controllers. On radius1 krb5.conf kdc = 3.3.3.3 kdc = 4.4.4.4 smb.conf password server = 3.3.3.3, 4.4.4.4 On radius2 krb5.conf kdc = 4.4.4.4 kdc = 3.3.3.3 smb.conf password server = 4.4.4.4, 3.3.3.3 For certificate, do we need a server certificate for both radius1 and radius2 if we want supplicant to verify the server certificate? Thanks, Schilling

5 6

Radiusd.conf
by Samuel Isaias Barriga Perez 15 Sep '10

15 Sep '10

Hello I have a question: I want to configure the radiusd.conf, here es my problem there es two radiusd.conf in diferent paths /usr/local/etc/raddb/radiusd.conf and /root/freeradius-server-2.1.9/raddb/radiusd.conf. which configuration file should I use... is there a manual to configure this module??? Thank You Samuel I. Barriga

3 2

unidentified users and vlan assignment
by Fabien COMBERNOUS 15 Sep '10

15 Sep '10

Hi, We use the freeradius to assigne users in the vlan. The default settings rejects users in case of a request from an unidentified user. Instead of this we would like assign him to a specific vlan. I don't find information about how to do this. Any pointer or information are wellcome. Regards, -- *Fabien COMBERNOUS* /unix system engineer/ www.kezia.com <http://www.kezia.com/> *Tel: +33 (0) 467 992 986* Kezia Group

2 8

NAS type with NAS defined in SQL (FR 2.1.6)
by John Doppke 15 Sep '10

15 Sep '10

I've tried dozens of ways but I can't figure out how to get the NAS type for clients defined in MySQL. The column is populated, the query has the correct fields matching the source code for the module. The module appears to populate the address, shortname, nastype, secret and virtual server. Yet when I expand "${client:nastype}" I only get a value for clients defined in the clients file. SQL clients are always blank. I know I could do a special SQL query on each request, but I shouldn't have to. The data should already be in a variable. -John

2 1

Error: "Discarding duplicate request..."
by Mike Diggins 15 Sep '10

15 Sep '10

Our students have returned this week, and I've noticed a couple new messages logged to my FreeRadius 2.1.3 server. When it happens, my controllers fail over to the secondary Radius server. This has happened a few times. My Radius servers are only lightly loaded, and only configured to do authentication. No databases. Any idea what might be causing this? Sep 15 10:06:44 prad02 radiusd[10632]: Discarding duplicate request from client wlc-8 port 32769 - ID: 218 due to unfinished request 35236 Sep 15 10:07:01 prad02 radiusd[10632]: Discarding duplicate request from client wlc-8 port 32769 - ID: 219 due to unfinished request 35237 Sep 15 10:07:24 prad02 radiusd[10632]: Discarding duplicate request from client wlc-8 port 32769 - ID: 220 due to unfinished request 35239 Sep 15 10:07:41 prad02 radiusd[10632]: WARNING: Unresponsive child for request 35239, in module component Sep 15 10:07:52 prad02 radiusd[10632]: WARNING: Unresponsive child for request 35240, in module component Sep 15 10:07:53 prad02 radiusd[10632]: Discarding duplicate request from client wlc-7 port 32769 - ID: 173 due to unfinished request 35240 Sep 15 10:07:53 prad02 radiusd[10632]: Discarding duplicate request from client wlc-8 port 32769 - ID: 220 due to unfinished request 35239 Sep 15 10:07:53 prad02 radiusd[10632]: Discarding duplicate request from client wlc-7 port 32769 - ID: 173 due to unfinished request 35240 Sep 15 10:07:53 prad02 radiusd[10632]: Discarding duplicate request from client wlc-8 port 32769 - ID: 220 due to unfinished request 35239 Sep 15 10:07:53 prad02 radiusd[10632]: Discarding duplicate request from client wlc-8 port 32769 - ID: 221 due to unfinished request 35244 Sep 15 10:07:53 prad02 radiusd[10632]: Discarding duplicate request from client wlc-8 port 32769 - ID: 221 due to unfinished request 35244 Sep 15 10:07:53 prad02 radiusd[10632]: Discarding duplicate request from client FHSWLC-1 port 32768 - ID: 205 due to unfinished request 35245 -Mike

2 1

Question about radiusclient
by Ali Majdzadeh 15 Sep '10

15 Sep '10

Hello All In the radiusclient configuration file there is an option called auth_order which accepts two values (local, radius). If we set this option as follows: auth_order radius,local doesn't it means that if the authentication fails using RADIUS it should be performed using the /etc/passwd file? In other words, if we define all those users, which are not mentioned as radius users, as local users of the machine where radiusclient runs, it should be OK. Is that right? I have tested the so-called scenario, but it does not work. Does anyone have any experiences regarding this issue? Warm Regards Ali Majdzadeh Kohbanani

1 0

Policy Based on NAS IP address
by Nasser Heidari 15 Sep '10

15 Sep '10

Hi, Is it possible to apply special policy based on NAS IP Address, for example I want to check originating ip address for special NAS or set IP Address pool for the other NAS . Thanks in advance

2 1

Echo Effect Help
by Deepak 15 Sep '10

15 Sep '10

Hi, I don't know how to explain this problem. Sounds completely crazy. I have a freeRADIUS 2.1.7 (in CentOS 5.5) setup with MySQL backend to be used with dd-wrt chilli. I have tested in three separate line exchanging the location of radius and chilli but in particular line I found out that radius is behaving abnormally, which I called Echo Effect. When radius is put in that particular line, it doesn't respond to the request from chilli on one particular line of the other two lines. For Example: If radius is in Line 1, it processes the request from Line 2 but completely ignores from Line 3. By line I mean three separate DSL lines. If NAS is put inside the same subnet and authenticated locally, 'radacct' table gets about 20+ entries for single account login. Also noticed in debug mode that it is updating accounting information every second, while account intermin interval is set for every minute. After sometime 'radacct' table gets empty and doesn't get updated even if users are still logged in. To check that phenomenon, I left it on with about 10 users logged in. After sometime it crashed. This kind of repetition happens only in that line (with local authentication) but not on other lines. Same experiments done with radius on other two lines does not show any of these symptoms. 1. Does anyone have any experience in this kind of problem before? 2. Regarding the ignoring of request from particular line, does radius have some kind of self defense mechanism by blocking IP? Where to look for the clue? 3. What can trigger account update every second and multiple entry in 'radacct'? Regards Deepak

2 2

FreeRadius crashed on loading test.
by Konstantin Chekushin 15 Sep '10

15 Sep '10

Good day. I want to continue Dinh Pham Cong topic ((FreeRadius crashed on accounting load tests with 1000 concurrent clients - Tue, 10 Nov 2009 01:39:30 -0800 )) I use freeradius 2.1.9 Linux myhost 2.6.26-2-amd64 Some info from radiusd.conf : -------------- max_request_time = 30 cleanup_delay = 5 max_requests = 2048 hostname_lookups = no allow_core_dumps = yes regular_expressions     = yes extended_expressions    = yes log {         destination = files         file = ${logdir}/radius.log         syslog_facility = daemon         stripped_names = no         auth = yes         auth_badpass = yes         auth_goodpass = yes } checkrad = ${sbindir}/checkrad security {         max_attributes = 200         reject_delay = 1         status_server = yes } proxy_requests  = no $INCLUDE clients.conf thread pool {         start_servers = 5         max_servers = 32         min_spare_servers = 3         max_spare_servers = 10         max_requests_per_server = 0 } -------------- I'm using rlm_sql for my own ippool module: database = "mysql" num_sql_socks = 32 I've started ./radius -xxx -f I've prepared huge file with auth requests for sending: Packet-Type = Access-Request NAS-Identifier = "nas1" User-Name = "test" User-Password = "test" NAS-IP-Address = 212.93.99.126 NAS-Port-Type = Virtual Called-Station-Id = "1000" Calling-Station-Id = "37129111111" Service-Type = Framed-User Framed-Protocol = GPRS-PDP-Context Acct-Session-Id = "d45d637e72d54736" Acct-Multi-Session-Id = "d45d637e396391a1" Packet-Type = Access-Request NAS-Identifier = "nas1" User-Name = "test2" User-Password = "test2" NAS-IP-Address = 212.93.99.126 NAS-Port-Type = Virtual Called-Station-Id = "3" Calling-Station-Id = "37126222222" Service-Type = Framed-User Framed-Protocol = GPRS-PDP-Context Acct-Session-Id = "d45d637e5b97ac8e" Acct-Multi-Session-Id = "d45d637e2dc41c4e" and so on then, I've run radclient: cat auth-det.log |/usr/local/freeradius2.1.9/bin/radclient -c 1 -p 500 -q localhost:1812 auth testkey my module process requests too slow (I will discover this problem in few days, this is mysql-db-cluster issues), but this test causes radiusd segmentation fault. I've grabbed the core and look what it shows: Core was generated by `./radiusd -xxx -f'. Program terminated with signal 11, Segmentation fault. [New process 7173] [New process 7180] [New process 7181] [New process 7182] [New process 7183] [New process 7185] [New process 7187] [New process 7188] [New process 7191] [New process 7193] [New process 7196] [New process 7197] [New process 7174] [New process 7199] [New process 7177] [New process 7202] [New process 7203] [New process 7205] [New process 7176] [New process 7175] [New process 7184] [New process 7186] [New process 7189] [New process 7190] [New process 7192] [New process 7194] [New process 7195] [New process 7198] [New process 7200] [New process 7201] [New process 7204] [New process 7206] [New process 7107] #0  request_pre_handler (request=0xb493fc20) at event.c:1769 1769            if (request->packet->dst_port == 0) { (gdb) bt #0  request_pre_handler (request=0xb493fc20) at event.c:1769 #1  0x0806e404 in radius_handle_request (request=0xb493fc20, fun=0x804ef20 <rad_authenticate>) at event.c:3728 #2  0x08066970 in request_handler_thread (arg=0xae9cbf8) at threads.c:493 #3  0xb780e4c0 in start_thread () from /lib/i686/cmov/libpthread.so.0 #4  0xb75b684e in clone () from /lib/i686/cmov/libc.so.6 And here is last breath of my radius (from radius.log) Tue Sep 14 16:44:43 2010 : Info: WARNING: Child is hung for request 16359 in component  module . Tue Sep 14 16:44:43 2010 : Info: WARNING: Child is hung for request 16366 in component  module . Tue Sep 14 16:44:43 2010 : Info: WARNING: Child is hung for request 16369 in component  module . Tue Sep 14 16:44:43 2010 : Info: WARNING: Child is hung for request 16383 in component  module . Tue Sep 14 16:44:43 2010 : Debug: Waking up in 0.1 seconds. Tue Sep 14 16:44:43 2010 : Info: Cleaning up request 16169 ID 189 with timestamp +952 Tue Sep 14 16:44:43 2010 : Info: Child is finally responsive for request 14864 Tue Sep 14 16:44:43 2010 : Info: WARNING: Child is hung for request 16165 in component post-auth module lmtsqlippool1. Tue Sep 14 16:44:43 2010 : Info: WARNING: Child is hung for request 16186 in component post-auth module lmtsqlippool1. Tue Sep 14 16:44:43 2010 : Info: WARNING: Child is hung for request 16189 in component post-auth module lmtsqlippool1. *** Tue Sep 14 16:44:43 2010 : Info: WARNING: Child is hung for request 16241 in component post-auth module lmtsqlippool1. Tue Sep 14 16:44:43 2010 : Info: WARNING: Child is hung for request 16243 in component post-auth module lmtsqlippool1. Tue Sep 14 16:44:43 2010 : Debug: Waking up in 0.1 seconds. Tue Sep 14 16:44:43 2010 : Info: Cleaning up request 16223 ID 21 with timestamp +952 Tue Sep 14 16:44:43 2010 : Debug: Waking up in 0.1 seconds. Tue Sep 14 16:44:43 2010 : Info: Cleaning up request 16173 ID 190 with timestamp +952 Tue Sep 14 16:44:43 2010 : Info: WARNING: Child is hung for request 16165 in component post-auth module lmtsqlippool1. Tue Sep 14 16:44:43 2010 : Info: WARNING: Child is hung for request 16186 in component post-auth module lmtsqlippool1. *** Tue Sep 14 16:44:43 2010 : Info: WARNING: Child is hung for request 16241 in component post-auth module lmtsqlippool1. Tue Sep 14 16:44:43 2010 : Info: WARNING: Child is hung for request 16243 in component post-auth module lmtsqlippool1. Tue Sep 14 16:44:43 2010 : Info: Cleaning up request 16174 ID 151 with timestamp +952 Tue Sep 14 16:44:43 2010 : Debug: Waking up in 0.1 seconds. Tue Sep 14 16:44:43 2010 : Info: Cleaning up request 16177 ID 58 with timestamp +952 Tue Sep 14 16:44:44 2010 : Info: Cleaning up request 16181 ID 60 with timestamp +952 Tue Sep 14 16:44:44 2010 : Debug: rlm_sql_mysql: query:  COMMIT Tue Sep 14 16:44:44 2010 : Info: [lmtsqlippool1]        expand: UPDATE ippool SET active=1, username=%{Calling-Station-Id} WHERE username=0 AND iprange_id IN (2) LIMIT 1 -> UPDATE ippool SET active=1, username=37126333333 WHERE username=0 AND iprange_id IN (2) LIMIT 1 Tue Sep 14 16:44:44 2010 : Debug: rlm_sql_mysql: query:  UPDATE ippool SET active=1, username=37126333333 WHERE username=0 AND iprange_id IN (2) LIMIT 1 Tue Sep 14 16:44:44 2010 : Debug: rlm_sql (sql1): Released sql socket id: 19 Tue Sep 14 16:44:44 2010 : Info: ++++[lmtsqlippool1] returns ok Tue Sep 14 16:44:44 2010 : Info: +++- policy redundant returns ok Tue Sep 14 16:44:44 2010 : Info: ++- else else returns ok Tue Sep 14 16:44:44 2010 : Info: } # server localonly Tue Sep 14 16:44:44 2010 : Info: request 16165 was cancelled. Tue Sep 14 16:44:44 2010 : Info: Finished request 16165. Tue Sep 14 16:44:44 2010 : Debug: Going to the next request Tue Sep 14 16:44:44 2010 : Debug: Thread 1 waiting to be assigned a request Tue Sep 14 16:44:44 2010 : Debug: Thread 1 got semaphore Tue Sep 14 16:44:44 2010 : Debug: Thread 1 handling request 16244, (20 handled so far) Looks like a bug, am I right?

3 3