September 2010 - Freeradius-Users - lists.freeradius.org

Re: Freeradius-Users Digest, Vol 65, Issue 8
by t.drollinger＠i-motion.de 03 Sep '10

03 Sep '10

Ich bin von Freitag den 03.09.2010 bis Freitag den 24.09.2010 nicht im Haus und kann Ihre Nachricht erst am Montag den 27.09.2010 bearbeiten. In dringenden Fällen wenden Sie sich bitte an meinen Kollegen Herrn Böhm (E-Mail: r.boehm(a)i-motion.de) Mit freundlichen Grüßen Tobias Drollinger

1 0

Error compiling over Solaris
by Fernando Calvelo Vazquez 02 Sep '10

02 Sep '10

Hi folk: I'm trying to compile 'freeradius-2.1.9' over Solaris 10 platform. No errors during './configure' execution But I get this messages when I execute 'gmake' command gcc .libs/radiusdS.o -o .libs/radiusd .libs/acct.o .libs/auth.o .libs/client.o .libs/conffile.o .libs/crypt.o .libs/exec.o .libs/files.o .libs/listen.o .libs/log.o .libs/mainconfig.o .libs/modules.o .libs/modcall.o .libs/radiusd.o .libs/stats.o .libs/session.o .libs/threads.o .libs/util.o .libs/valuepair.o .libs/version.o .libs/xlat.o .libs/event.o .libs/realms.o .libs/evaluate.o .libs/vmps.o .libs/detail.o -L/usr/lib/ -L/usr/local/libexec/openldap/ -L/usr/local/lib/ -L/opt/csw/lib/ -L/opt/csw/lib/engines/sparcv9/ -L/lib/ /usr/local/source/freeradius-server-2.1.9/src/lib/.libs/libfreeradius-radius.so -lnsl -lresolv -lsocket -lposix4 -lpthread -lcrypt /opt/csw/lib/libltdl.so -lncurses -lsunmath -lm /opt/csw/lib/libintl.so -L/opt/csw/lib -lc -ldl -L/usr/openwin/lib /opt/csw/lib/libiconv.so -R/usr/local/freeradius-2.1.7/lib -R/opt/csw/lib -R/usr/lib/ -R/usr/local/libexec/openldap/ -R/usr/local/lib/ -R/opt/csw/lib/ -R/opt/csw/lib/engines/sparcv9/ -R/lib/ Undefined first referenced symbol in file ERR_clear_error .libs/threads.o OPENSSL_add_all_algorithms_noconf .libs/threads.o CRYPTO_set_locking_callback .libs/threads.o CRYPTO_num_locks .libs/threads.o CRYPTO_set_id_callback .libs/threads.o ERR_remove_state .libs/threads.o lt__PROGRAM__LTX_preloaded_symbols .libs/modules.o ld: fatal: Symbol referencing errors. No output written to .libs/radiusd collect2: ld returned 1 exit status gmake[4]: *** [radiusd] Error 1 gmake[4]: Leaving directory `/usr/local/source/freeradius-server-2.1.9/src/main' gmake[3]: *** [main] Error 2 gmake[3]: Leaving directory `/usr/local/source/freeradius-server-2.1.9/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/usr/local/source/freeradius-server-2.1.9/src' gmake[1]: *** [src] Error 2 gmake[1]: Leaving directory `/usr/local/source/freeradius-server-2.1.9' gmake: *** [all] Error 2 Any clues with library could be causing the crash? Cheers, Swatzy.

2 2

ldap group lookup help
by Walter Gould 02 Sep '10

02 Sep '10

Group, We are having problems with ldap group lookups... Here's our environment. Using Freeradius 2.1.8 to authenticate wireless users against our AD servers and perform ldap group membership lookups. Using WPA2-AES-PEAP-MSCHAPv2. When radiusd is started, initially the lookups work fine and we see successful auth's in our radius logs. But, after some period of time, we eventually begin to see bunches of "Invalid user:" radius logs. The only thing that seems to fix this is to remove the ldap group lookups from the freeradius config. In our ldap module, the basedn we specify is dc=auburn,dc=edu (as we have multiple user ou's). Not sure if that might be causing an issue or not..? One thing I have noticed is there are 3 ldap group lookups that each say "rlm_ldap::ldap_groupcmp: User found in group xxxx". I have read posts about configuring the ldap module to us the inner-tunnel - which I have done. Is there anyway to reduce the number of group lookups to only one? Not sure if the extra lookups are causing unneeded traffic which may be causing issues? Also, I see 10 Access-Request packets and about the same number of Access-Challenge packets.. Is this normal? Just wondering if excessive unneeded traffic is what is overloading the AD/ldap servers? Any help or suggestions will be appreciated. Thanks, Walter Gould Auburn University

1 0

Simultaneous use
by Tom Cooper 02 Sep '10

02 Sep '10

hi all, I have to implement Simultaneous-Use on my freeraduis. Running freeradius-2.1.9-2 on CentOS 5.4 64 bit. I have followed all the steps listed here: http://www.how2forge.org/authentication-authorization-and-accounting-with-f… I also uncommented the SQL queries that check for simultaneous use. Unfortunately I did not get past first base. Can anybody give me a few pointers, please? Thanks, Tom To read FirstRand Bank's Disclaimer for this email click on the following address or copy into your Internet browser: https://www.fnb.co.za/disclaimer.html If you are unable to access the Disclaimer, send a blank e-mail to firstrandbankdisclaimer(a)fnb.co.za and we will send you a copy of the Disclaimer.

2 1

Failed (re-)authentification after some time...
by Jan Zacharias 02 Sep '10

02 Sep '10

Something strange is going on: we do re-authentification every ten seconds with one WinXP SP3 client hooked up to a Cisco 3560G Switch. The reauth interval is small to stress-test the setup. It works w/a problems for 1-2 Days, then we get: Sun Aug 15 10:00:51 2010 : Auth: Login OK: [jan/<via Auth-Type = EAP>] (from client swba1-00-test port 0 via TLS tunnel) Sun Aug 15 10:00:51 2010 : Auth: Login OK: [jan/<via Auth-Type = EAP>] (from client swba1-00-test port 50043 cli 00-08-74-46-34-F7) Sun Aug 15 10:01:05 2010 : Auth: Login OK: [jan/<via Auth-Type = EAP>] (from client swba1-00-test port 0 via TLS tunnel) Sun Aug 15 10:01:05 2010 : Auth: Login OK: [jan/<via Auth-Type = EAP>] (from client swba1-00-test port 50043 cli 00-08-74-46-34-F7) Sun Aug 15 10:01:20 2010 : Auth: Login OK: [jan/<via Auth-Type = EAP>] (from client swba1-00-test port 0 via TLS tunnel) Sun Aug 15 10:01:20 2010 : Auth: Login OK: [jan/<via Auth-Type = EAP>] (from client swba1-00-test port 50043 cli 00-08-74-46-34-F7) Sun Aug 15 10:01:39 2010 : Error: Discarding duplicate request from client swba1-00-test port 1645 - ID: 157 due to unfinished request 125603 Sun Aug 15 10:01:44 2010 : Error: Child PID 30686 is taking too much time: forcing failure and killing child. Sun Aug 15 10:01:44 2010 : Auth: Login incorrect: [jan/<via Auth-Type = EAP>] (from client swba1-00-test port 0 via TLS tunnel) Sun Aug 15 10:01:44 2010 : Auth: Login incorrect: [jan/<via Auth-Type = EAP>] (from client swba1-00-test port 50043 cli 00-08-74-46-34-F7) The last two entries are due to the crappy windows client. If auth fails once, it thinks, that the saved auth info is wrong and deletes it, querying the user to enter mschap(PEAP) login/pw again. The entry Sun Aug 15 10:01:39 2010 is interesting as no client was connected to port 1645 at that time and the two days before, however it seems as if this triggers the timeout initially. My question: can I somehow extend the timeout or do anything else to prevent this from happening?

2 9

RE: ask for help on WiMAX + Freeradius + Disconnec
by Xiaochen 02 Sep '10

02 Sep '10

Subject: RE? RE: ask for help on WiMAX + Freeradius + Disconnect To: <freeradius-users(a)lists.freeradius.org> Message-ID: <005b01cb4a33$19178370$4b468a50$@com> Content-Type: text/plain; charset="gb2312" Message: 4 Date: Wed, 1 Sep 2010 09:35:53 -0500 From: "Ben Wiechman" <wiechman.lists(a)gmail.com> Subject: RE: ask for help on WiMAX + Freeradius + Disconnect To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <4c7e64c3.c84de70a.22a4.27c3(a)mx.google.com> Content-Type: text/plain; charset="iso-2022-jp" Step 1: Read the wimax dictionary file. It will help you understand what types of data you need to be putting into each attribute. update disconnect { User-Name = "%{User-Name}" Calling-Station-Id = "%{Calling-Station-Id}" WiMAX-AAA-Session-Id = "%{WiMAX-AAA-Session-Id}" WiMAX-DM-Action-Code = Deregister-MS } The session ID needs to be identical to the one returned to the ASN-GW during network entry. man unlang for more info. For testing from the CLI echo the required attributes into radclient. man radclient Ben *********** Use attributes that are defined in the WiMAX dictionary. Or, update the WiMAX dictionary to include the attributes you're using. Alan DeKok. >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> Thanks Alan and Ben, I will try today and email the result in the mailing list. Xiaochen >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> Thanks Alan and Ben, It works. I also found why it couldn't pass --- I used Freeradius 1.1.7 before. Today I tried freeradisu 2.1.9 which fully support CoA and DM. Best regards! Xiaochen

1 0

回复：
by John 02 Sep '10

02 Sep '10

--- 10年9月2日，周四, John <elmer_radius(a)yahoo.com.cn> 写道：发件人: John <elmer_radius(a)yahoo.com.cn> 主题: 收件人: freeradius-users(a)lists.freeradius.org 日期: 2010年9月2日,周四,下午12:45 Hi all, We upgrade freeradius from 1.1.6 to 2.1.18 recently. Looks 2.1.8 will reply a Access-Reject when [ldap] return fail, but 1.1.6 is just keep silence. Is there a way to let 2.1.8 reply nothing in the case? Listening on authentication address * port 1812 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.155.20.85 port 32770, id=182, length=130 Service-Type = Authorize-Only NAS-Port-Type = Wireless-802.11 User-Name = "test2008" MS-CHAP-Challenge = 0x766bb4f5ae93e28b4630b8fbc674e137 MS-CHAP2-Response = 0x3700e851effcf3aa3f7731204ca90dcbd98300000000000000006c9248ca4d87e72d0b4a91dbd2672bb1f8f5b725187953ff NAS-IP-Address = 10.155.20.85 +- entering group authorize {...} ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok [eap] No EAP-Message, not doing EAP ++[eap] returns noop [ldap] performing user authorization for test2008 [ldap] expand: (sAMAccountName=%{mschap:User-Name}) -> (sAMAccountName=test2008) [ldap] expand: OU=Domain Controllers,dc=aero-hz,dc=cn -> OU=Domain Controllers,dc=aerohive-hz,dc=cn [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to 10.155.3.2:389, authentication 0 [ldap] bind as hhe(a)aero-hz.cn/w200h to 10.155.3.2:389 [ldap] hhe(a)aero-hz.cn bind to 10.155.3.2:389 failed: Can't contact LDAP server [ldap] (re)connection attempt failed [ldap] search failed [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns fail Sending Access-Reject of id 182 to 10.155.20.85 port 32770 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 182 with timestamp +10 Ready to process requests.

1 0

RE： RE: ask for help on WiMAX + Freeradius + Disconnect
by Xiaochen 01 Sep '10

01 Sep '10

Message: 4 Date: Wed, 1 Sep 2010 09:35:53 -0500 From: "Ben Wiechman" <wiechman.lists(a)gmail.com> Subject: RE: ask for help on WiMAX + Freeradius + Disconnect To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <4c7e64c3.c84de70a.22a4.27c3(a)mx.google.com> Content-Type: text/plain; charset="iso-2022-jp" Step 1: Read the wimax dictionary file. It will help you understand what types of data you need to be putting into each attribute. update disconnect { User-Name = "%{User-Name}" Calling-Station-Id = "%{Calling-Station-Id}" WiMAX-AAA-Session-Id = "%{WiMAX-AAA-Session-Id}" WiMAX-DM-Action-Code = Deregister-MS } The session ID needs to be identical to the one returned to the ASN-GW during network entry. man unlang for more info. For testing from the CLI echo the required attributes into radclient. man radclient Ben *********** Use attributes that are defined in the WiMAX dictionary. Or, update the WiMAX dictionary to include the attributes you're using. Alan DeKok. >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> Thanks Alan and Ben, I will try today and email the result in the mailing list. Xiaochen

1 0

control-socket on freeradius 2.1.8
by JOE 01 Sep '10

01 Sep '10

Hi all I'm trying to configure control-socket functionality on freeradius 2.1.8. Radius in debug mode shows: radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 1645 } listen { type = "acct" ipaddr = * port = 1646 } listen { type = "control" listen { socket = "/opt/freeradius/var/run/radiusd/radiusd.sock" uid = "testuser" gid = "users" mode = "rw" } } Listening on authentication address * port 1645 Listening on accounting address * port 1646 Listening on command file /opt/freeradius/var/run/radiusd/radiusd.sock Ready to process requests. The socket is created with this permissions: ls -ltr "/opt/freeradius/var/run/radiusd/radiusd.sock" srw-rw---- 1 radius radius 0 2010-09-01 20:18 /opt/freeradius/var/run/radiusd/radiusd.sock When I try to connect to the socket with radmin I received a permission denied: /opt/freeradius/sbin> ./radmin -d ../etc_devel/raddb/ radmin: Failed connecting to /opt/freeradius/var/run/radiusd/radiusd.sock: Permission denied radmin is launched with 'testuser' user. anyone know where is the problem? Regards

2 3

ask for help on WiMAX + Freeradius + Disconnect
by Xiaochen 01 Sep '10

01 Sep '10

Hello, friends, As I met some problems when using Freeradius to send Disconnect Request. Hope you can give me any suggestions. Please let me describe my issue. First I created a packete.txt for radclinet.exe. The content of packet.txt is as: Acct-Session-Id="00000001" Calling-Station-Id="001E310008CC" User-Name="wimax" X-Ascend-Session-Svr-Key="0123456789" NAS-IP-Address=100.1.6.5 NAS-Identifier=100.1.6.5 WiMAX-Session-ID=��XXXXXXX�� WiMAX-DM-Action-Code=��0000ffff�� After packet.txt was sent to AGW, radclinet debug window said: ��Unknown WiMAX-Session �CID or Unknown WiMAX-DM-Action-Code �� WiMAX NWG 1.3 says: 5.4.1.7 RADIUS Disconnect Request Message isconnect Request message should be defined with the following: User-Name��Calling-Station-Id�� WiMAX-Session-ID�� WiMAX-DM-Action-Code So I must add and make WiMAX-Session-ID and WiMAX-DM-Action-Code sent by Freeradius. Could you please give me any suggestions on how to add the attribute of WiMAX-Session-ID and WiMAX-DM-Action-Code into the sent message ? Thanks a lot for your help in advance! Xiaochen Chen @ WiMAX Test Lab Beiing , China

2 1