September 2010 - Freeradius-Users - lists.freeradius.org

Unix Group based White-List
by Sid Stuart 29 Sep '10

29 Sep '10

We would like to configure authentication using the Unix module. We would also like to have a white-list based on a group in /etc/group. We created an entry in the /etc/raddb/users file that looks like, DEFAULT Group == "enabled", Auth-Type := System Unfortunately, this passes all users with a valid account through, even when they are not listed in the group. We can set up a blacklist with DEFAULT Group == "disabled", Auth-Type := Reject Reply-Message = "Your account has been disabled." DEFAULT Auth-type := System but would prefer a white-list approach. Does anyone know how to do this? Sid

2 1

Radius not recording - The maximum number of threads (300) are active, cannot spawn new thread to handle request
by Marie Tambe 29 Sep '10

29 Sep '10

Can someone help with this Please. I always have restart server before radius can record again on Sep 20 18:45:19 2010 : Info: The maximum number of threads (300) are active, cannot spawn new thread to handle request Mon Sep 20 18:45:19 2010 : Info: The maximum number of threads (300) are active, cannot spawn new thread to handle request Mon Sep 20 18:45:19 2010 : Info: The maximum number of threads (300) are active, cannot spawn new thread to handle request Mon Sep 20 18:45:19 2010 : Info: The maximum number of threads (300) are active, cannot spawn new thread to handle request Mon Sep 20 18:45:19 2010 : Error: WARNING: Unresponsive child (id 180550544) for request 6431961 Mon Sep 20 18:45:19 2010 : Error: WARNING: Unresponsive child (id 2446359440) for request 6431965 Mon Sep 20 18:45:19 2010 : Info: The maximum number of threads (300) are active, cannot spawn new thread to handle request Mon Sep 20 18:45:19 2010 : Error: Dropping conflicting packet from client att:1646 - ID: 63 due to unfinished request 6434567 Mon Sep 20 18:45:19 2010 : Error: Dropping conflicting packet from client att:1646 - ID: 65 due to unfinished request 6433323 Mon Sep 20 18:45:19 2010 : Error: WARNING: Unresponsive child (id 2939382672) for request 6431951 Mon Sep 20 18:45:19 2010 : Error: WARNING: Unresponsive child (id 3086240656) for request 6431963 Mon Sep 20 18:45:19 2010 : Error: Dropping conflicting packet from client att:1646 - ID: 155 due to unfinished request 6433435 Mon Sep 20 18:45:19 2010 : Error: WARNING: Unresponsive child (id 3044281232) for request 6431966 Mon Sep 20 18:45:19 2010 : Error: WARNING: Unresponsive child (id 1869417360) for request 6432076 Mon Sep 20 Thanks and Regards Marie ________________________________ The information contained in this email and any attachments is strictly confidential and is for the use of the intended recipient. Any use, dissemination, distribution, or reproduction of any part of this email or any attachment is prohibited. If you are not the intended recipient, please notify the sender by return email and delete all copies including attachments.

4 10

the WARNING message when client doesn't respond any more...
by Stefan Winter 29 Sep '10

29 Sep '10

... that went into 2.1.10 is a great piece of functionality, and can help a lot in debugging. However, it would be even more useful if this information made it into radius.log (since otherwise it won't surface unless in debugging mode), sth like: Auth: Login ABORTED: [userfoo] (from client bar-v4 port 19181) ceased EAP conversation prematurely. Our helpdesk (and we're certainly not the only ones) would appreciate if we could easily figure out and say: "Your client software apparently doesn't like us. Go away and configure it according to the documentation!" Of course the information in the middle of an EAP session is incomplete (no inner identity!), but if at least the outer identity and Calling-Station-Id could be logged alongside, that would be great. (I guess it's asked too much get a handle for this situation and get the ability to execute custom SQL statements for that... right?) Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

2 3

Problemes between 2.1.8 and 2.19 with NT-Password and LDAP
by Miquel Canes 29 Sep '10

29 Sep '10

Hello, I'm having some troubles updating the FreeRadius version between 2.1.8 and 2.1.9. I'm using two different machines using a very similar configurations (some changes on clients.conf and other small changes) one with the 2.1.8 and the other with the 2.1.9 versions. FreeRadius 2.1.8 is working perfect but FreeRadius 2.1.9 fails with the NT-Password stored on LDAP. Authentication with NT-Password fails on Freeradius 2.1.9. I have the two output files: FreeRadius 2.1.8 output file http://pastebin.ca/1951039 FreeRadius 2.1.9 autput file http://pastebin.ca/1951040 This files contains more than 1500 lines of output so checking it it's not fast. So I think that the main problem is located on this part of the 2.1.9 output: (near line 1100) [ldapuser] performing user authorization for user [ldapuser] expand: (&(uid=%{User-Name})) -> (&(uid=user)) [ldapuser] expand: ou=Auten,o=xx,c=es -> ou=Auten,o=xx,c=es [ldapuser] ldap_get_conn: Checking Id: 0 [ldapuser] ldap_get_conn: Got Id: 0 [ldapuser] performing search in ou=Auten,o=xx,c=es, with filter (&(uid=user)) [ldapuser] looking for check items in directory... [ldapuser] ntPassword -> NT-Password == 0x3641343935364634344242333245413934324241424544303242363337344641 [ldapuser] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldapuser] user user authorized to use remote access [ldapuser] ldap_release_conn: Release Id: 0 ++[ldapuser] returns ok [eap] EAP packet type response id 141 length 144 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x028d00411a028d003c31b02eb642fafae8883512337347472ebb000000000000000073bf979f67d820f838c095f2805eea20b933d3c63f40a4c1006d63616e6573 server { PEAP: Setting User-Name to user Sending tunneled request EAP-Message = 0x028d00411a028d003c31b02eb642fafae8883512337347472ebb000000000000000073bf979f67d820f838c095f2805eea20b933d3c63f40a4c1006d63616e6573 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "user" State = 0x5bf416ba5b790c781a701a2fac1738f6 server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 141 length 65 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for user with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject As I can see, NT-Password from LDAP is not found by the mschap module. Checking this part of the output with the 2.1.8 file, i got this: (Correct output from 2.1.8 version, near line 1200) [ldapuser] performing user authorization for user [ldapuser] expand: (&(uid=%{User-Name})) -> (&(uid=user)) [ldapuser] expand: ou=Auten,o=xx,c=es -> ou=Auten,o=xx,c=es [ldapuser] ldap_get_conn: Checking Id: 0 [ldapuser] ldap_get_conn: Got Id: 0 [ldapuser] performing search in ou=Auten,o=xx,c=es, with filter (&(uid=user)) [ldapuser] looking for check items in directory... [ldapuser] ntPassword -> NT-Password == 0x3641343935364634344242333245413934324241424544303242363337344641 [ldapuser] looking for reply items in directory... [ldapuser] uid -> User = "user" WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldapuser] user user authorized to use remote access [ldapuser] ldap_release_conn: Release Id: 0 ++[ldapuser] returns ok [eap] EAP packet type response id 135 length 144 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x028700411a0287003c31d0cc5502bcdeef559de609c8268f3dd300000000000000003011b20a6a21675e82f3d176866be42295a9ba4e0ea4bd87006d63616e6573 server { PEAP: Setting User-Name to user Sending tunneled request EAP-Message = 0x028700411a0287003c31d0cc5502bcdeef559de609c8268f3dd300000000000000003011b20a6a21675e82f3d176866be42295a9ba4e0ea4bd87006d63616e6573 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "user" State = 0x23676bf823e071513e7de13f5545f696 server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 135 length 65 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [ldapuser] performing user authorization for user [ldapuser] expand: (&(uid=%{User-Name})) -> (&(uid=user)) [ldapuser] expand: ou=Auten,o=xx,c=es -> ou=Auten,o=xx,c=es [ldapuser] ldap_get_conn: Checking Id: 0 [ldapuser] ldap_get_conn: Got Id: 0 [ldapuser] performing search in ou=Auten,o=xx,c=es, with filter (&(uid=user)) [ldapuser] looking for check items in directory... [ldapuser] ntPassword -> NT-Password == 0x3641343935364634344242333245413934324241424544303242363337344641 [ldapuser] looking for reply items in directory... [ldapuser] uid -> User = "user" WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldapuser] user user authorized to use remote access [ldapuser] ldap_release_conn: Release Id: 0 ++[ldapuser] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Normalizing NT-Password from hex encoding [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] Found NT-Password [mschap] Told to do MS-CHAPv2 for user with NT-Password [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok NT-Password is found here and authentication works correctly on the next handled request. How can I fix this error? Any change between versions change the method to check NT-Password from LDAP? I have no ideas about how to fix this problem. I understand that check big debug outputs is not easy. But if somebody can give me a hand I appreciate it. Thank you, Miquel

2 2

Re: doubt regarding free-radius
by Michael Bathe 29 Sep '10

29 Sep '10

Hi, I couldn't solve my problem with this package. I think that not all dependencies could be fulfilled because of my core-installation. Finally I installed free-radius from blastwave wget http://download.blastwave.org/csw/pkgutil_i386.pkg pkgadd -d pkgutil_i386.pkg pkgutil --catalog pkgutil -a freeradius pkgutil -i freeradius # if there are problems with generating certs following worked for me cd /opt/csw/etc/raddb/certs/ date > ./random ./bootstrap radiusd -X Michael Am 29.09.2010 14:33, schrieb vijay: > Hi, > i saw your posting regarding segmentation-fault while run > following command on solaris10-x86. > > /usr/local/sbin/radiusd -X > > Iam also facing same problem.How you resolved it.It will be helpful to me. > > > > vijay > -- Michael Bathe Rechenzentrum -Netzwerkadministration- Tel.: +49 (0)331/288-1803 Fax: +49 (0)331/288-1730 Email: michael.bathe(a)gfz-potsdam.de ___________________________________ Helmholtz-Zentrum Potsdam Deutsches GeoForschungsZentrum - GFZ Stiftung des Öff. Rechts Land Brandenburg Telegrafenberg G257, D-14473 Potsdam

1 0

I have refered the doc again, and found some problem when the Vendor is PPP using simultaneous-use
by Spacelee 29 Sep '10

29 Sep '10

it says that for PPP, we should choose "other" in the type, but "other" means "don't bother checking, I believe what radutmp says". So which means if a user has a "stuck" entry in the session database she will not be able to login again. And I have met such problem also. When the wifi sudden shutdown or disconnect, which will leave the record of the user still online in the database, I have to clear it up manually, that 's not convenient. So what should I do with PPTP+PPP+Freeradius+MySQL when I have to set the simultaneous-use = 1 -- *Space Lee*

1 0

RE: New Install Problems
by Scott Miller 29 Sep '10

29 Sep '10

>> Been using FreeRadius for years now, no problems at all. Currently >> running 1.1 for over 5 years, upgrading the server and freeradius and am >> using Fedora 13. Downloaded the newest version, unzipped, went through >> config and ran into problems. ... >> /usr/bin/ld: .libs/radeapclient.o: undefined reference to symbol 'fr_perror' >> >> /usr/bin/ld: note: 'fr_perror' is defined in DSO >> /usr/local/lib/libfreeradius-radius-2.1.10.so so try adding it to the >> linker command line >> >> /usr/local/lib/libfreeradius-radius-2.1.10.so: could not read symbols: >> Invalid operation > > It's trying to link to the *installed* version of the library. This >is before the library has been installed. > > I'll put it down to a libtool issue. It has the happy trait of >re-writing build commands to reference libraries which don't exist. <sigh> > > Alan DeKok. >- Wondering if you happen to have a solution or work-around? Scott Miller

2 1

Core with 64Bit pam_radius_auth on Solaris 9
by Peter Lambrechtsen 29 Sep '10

29 Sep '10

Hello I've managed to compile pam_radius-1.3.17 both 32Bit and 64Bit. I had to add -lsocket as part of linking to get it to work and modified the make file to have -m64 to compile on 64bit When I compile it for 64Bit this is my make output: gcc -Wall -fPIC -m64 -c pam_radius_auth.c -o pam_radius_auth.o pam_radius_auth.c: In function `ipstr2long': pam_radius_auth.c:185: warning: subscript has type `char' pam_radius_auth.c: In function `good_ipaddr': pam_radius_auth.c:221: warning: subscript has type `char' pam_radius_auth.c: In function `host2server': pam_radius_auth.c:277: warning: subscript has type `char' pam_radius_auth.c: In function `rad_converse': pam_radius_auth.c:1027: warning: passing arg 3 of `pam_get_item' from incompatible pointer type pam_radius_auth.c:1030: warning: passing arg 2 of pointer to function from incompatible pointer type pam_radius_auth.c: In function `pam_sm_authenticate': pam_radius_auth.c:1081: warning: passing arg 2 of `pam_get_user' from incompatible pointer type pam_radius_auth.c:1097: warning: passing arg 3 of `pam_get_item' from incompatible pointer type pam_radius_auth.c:1102: warning: assignment from incompatible pointer type pam_radius_auth.c:1121: warning: passing arg 3 of `pam_get_item' from incompatible pointer type pam_radius_auth.c:1135: warning: passing arg 3 of `pam_get_item' from incompatible pointer type pam_radius_auth.c:1168: warning: passing arg 3 of `pam_get_item' from incompatible pointer type pam_radius_auth.c: In function `pam_private_session': pam_radius_auth.c:1300: warning: passing arg 2 of `pam_get_user' from incompatible pointer type pam_radius_auth.c:1321: warning: passing arg 3 of `pam_get_item' from incompatible pointer type pam_radius_auth.c: In function `pam_sm_chauthtok': pam_radius_auth.c:1407: warning: passing arg 2 of `pam_get_user' from incompatible pointer type pam_radius_auth.c:1428: warning: passing arg 3 of `pam_get_item' from incompatible pointer type pam_radius_auth.c:1437: warning: passing arg 3 of `pam_get_item' from incompatible pointer type pam_radius_auth.c:1442: warning: passing arg 3 of `pam_get_item' from incompatible pointer type gcc -Wall -fPIC -m64 -m64 -I/usr/local/include -R/usr/local/lib/sparcv9 -c md5.c gcc -R/usr/local/lib/sparcv9 -m64 -shared pam_radius_auth.o md5.o -lpam -lsocket -lc -o pam_radius_auth.so Which is all well and good. But when I try and use the 64Bit version of pamtester it core dumps. The 32Bit version compiles fine, and 32bit version of pamtester also works fine. ./pamtester jpam peter authenticate Password: Bus Error (core dumped) In /var/adm/messages I get: Sep 22 13:51:46 sf2428 genunix: [ID 603404 kern.notice] NOTICE: core_log: pamtester[13662] core dumped: /var/core/core_sol9_pamtester_0_0_1285120305_13662 Any suggestions on what to do with gdb or to debug this problem?? I've seen a number of posts such as this one: http://networking.itags.org/networking-tech/58575/ Talking about changing the typedef for md5.h -#define uint32 u_int32_t +#define uint32 uint32_t However 1.3.17 already seems to have this patch. struct MD5Context { uint32_t buf[4]; uint32_t bits[2]; unsigned char in[64]; }; I'm no C developer so not sure where to go to from here. Any suggestions would be gratefully accepted. Cheers Peter

2 8

Error
by Samuel Isaias Barriga Perez 29 Sep '10

29 Sep '10

Hi: I have installed Freeradius on my Debian server, after I debug, I got this error, can you hep me with this problem. Thank you Samuel Tue Sep 28 13:41:15 2010 : Error: Failed binding to authentication address * port 1812: Address already in use Tue Sep 28 13:41:15 2010 : Error: /usr/local/etc/raddb/radiusd.conf[240]: Error binding to port for 0.0.0.0 port 1812

3 2

FW: Session Resumption fails
by Panagiotis Georgopoulos 28 Sep '10

28 Sep '10

Forgot to mention that my FR's full log is here : http://pastebin.com/VWEaYAhP Cheers, Panos > Hello Alexander, all, > > Please see my comments inline... > > > > From: Alexander Clouter [mailto:alex@digriz.org.uk] > > Hi, > > > > * Panagiotis Georgopoulos <panos(a)comp.lancs.ac.uk> [2010-09-24 > > 22:33:14+0100]: > > > > > > I wish it was that simple! It seems that when I do > > "use_tunneled_reply > > > = yes" and although the authentication with FR succeeds, the 4-way > > > handshake between the client (wpa_supplicant 0.7.3) and the access > > > point (hostapd 0.7.2) fails with wpa_supplicant reporting : > > > > > /me does not recall saying enable 'copy_request_to_tunnel = yes'. > > With or without copy_request_to_tunnel enabled the outcome is the same > I am afraid, i.e. although full EAP-TTLS authentication succeeds the > end-client (not NAS) restarts EAP-TTLS authentication, when session > resumption and use_tunneled_reply are enabled on FreeRadius. > > (NB. when session resumption is off and use_tunneled_reply=no the full > communication goes fine and the client completes the 4-way handshake > after NAS gets EAP-Success). > > > > > State: ASSOCIATED -> 4WAY_HANDSHAKE > > > [snipped unread log] > > > EAPOL: Received EAP-Packet frame > > > > > > It seems that the Access Point realizes that the identity in FR's > > > reply has changed (from the outer identity to the inner one) and > > > somehow the client doesn't like this and doesn't reply to the 1st > > > message of the 4th way handshake. Instead it sends an EAPOL start > > > message and a full authentication restarts with the same outcome.. > > and then again and again. > > > > > Have you considered comparing the difference in the RADIUS packets > > going to-and-fro in both cases; the one where authentication works > and the > > one where it does not? What do you see? > > > > Yes I did, although I mostly concentrated on the 4-way handshake of the > client because this is where it is failing compared to without session > resumption. The end-client does not follow up the 1st message of the 4- > way handshake of the NAS, but decides to restart the full > authentication. > > (btw I was a bit more quick to send my previous email, because of the > impeding release of 2.1.10 where it was said that with session > resumption and use_tunneled_reply the session resumption should work, > but in my tests it wasn't. I wanted to see whether there was a quick > fix to be added to 2.1.10 before it gets released). > > As to the packet communication between the NAS and FreeRadius, there is > a change in the last packet (EAP-success) sent from FR to the NAS > compared to when authentication succeeds. Firstly it has as User-Name > attribute of the inner identity of the initial request and not the > outer one (which shouldn't cause the problem according to rfc 2865) and > secondly, it has MS-MPPE-Send-Key and MS-MPPE-Recv-Key *twice* which I > am guessing is causing the problem (rfc2548 as pointed out by > Alexander, helped me realize that). Why do they appear twice there, I > 've got no idea. > > Anyway, so what I thought to do is to go to the post-auth section of my > inner-server and add the following to remove the MS-MPPE-Send-Key and > MS-MPPE-Recv-Key attributes added by the inner-server and let the > default add its own. > > update reply { > MS-MPPE-Recv-Key !* 0x00 > MS-MPPE-Send-Key !* 0x00 > } > > Is the logic behind this fine or do you reckon it might break something > else in the future? > > The above solved the problem, in a sense, as now the end-client (pc) > authenticates just fine and finishes the 4-way handshake with the NAS. > However, session resumption still does not work. The server does add a > cache entry with the following : > > #Debug: SSL: adding session > 5705534d65ddd08de3b8649528274c1bc4e3d648bef7b643ffaf0f647afcac73 to > cache > #Info: [ttls] (other): SSL negotiation finished successfully > #Debug: SSL Connection Established > > ..but it does this every time a client tries to authenticate and it > never tries to really skip phase 2. I would really appreciate any ideas > on how I should fix this. > > Thanks a lot in advance, > Panos > > > >

1 0