January 2011 - Freeradius-Users - lists.freeradius.org

Re: Freeradius-Users Digest, Vol 69, Issue 67
by Samuel 20 Jan '11

20 Jan '11

Thanks, Thorsten Fischer. That was the solution. > Today's Topics: > > 1. Re: Logging Authentication Rejects (Alan DeKok) > 2. Freeradius2 + Daloradius (Samuel) > 3. Freeradius2 + Daloradius (Samuel) > 4. Re: Freeradius2 + Daloradius (Thorsten Fischer) > Message: 2 > Date: Thu, 20 Jan 2011 12:58:20 +0000 > From: Samuel<abeka(a)greatiam.com> > Subject: Freeradius2 + Daloradius > To: freeradius-users(a)lists.freeradius.org > Message-ID:<4D38316C.6080504(a)greatiam.com> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Please can someone shed light on what I must have done wrong. > I have Freeradius 2 installed on Centos 5.5 with Mysql 5 and added > Daloradius 0.9-8 as a frontend. > All seem OK except that I get an error with the radius logs. Daloradius > claims /var/log/radius/radius.log does not exist but it is there. > Dolaradius was looking originally for /var/log/freeradius/radius.log. I > have made changes in the ~/library/exten-radius_log.php file to look for > /var/log/radius/radius.log yet no success. Has anyone got a solution > please ? > > Thanks > > Samuel > > > > ------------------------------ > > Message: 3 > Date: Thu, 20 Jan 2011 13:00:24 +0000 > From: Samuel<abeka(a)greatiam.com> > Subject: Freeradius2 + Daloradius > To: freeradius-users(a)lists.freeradius.org > Message-ID:<4D3831E8.8000007(a)greatiam.com> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Pardon me if this has been addressed on this forum. > > Please can someone shed light on what I must have done wrong . I have > Freeradius 2 installed on Centos 5.5 with Mysql 5 and added Daloradius > 0.9-8 as a frontend. All seem OK except that I get an error with the > radius logs. Daloradius claims /var/log/radius/radius.log does not exist > but it is there. Dolaradius was looking originally for > /var/log/freeradius/radius.log. I have made changes in the > ~/library/exten-radius_log.php file to look for > /var/log/radius/radius.log yet no success. Has anyone got a solution > please ? > > Thanks > > Samuel > > > > ------------------------------ > > Message: 4 > Date: Thu, 20 Jan 2011 13:37:58 +0000 > From: Thorsten Fischer<thorsten(a)net.t-labs.tu-berlin.de> > Subject: Re: Freeradius2 + Daloradius > To: freeradius-users<freeradius-users(a)lists.freeradius.org> > Message-ID:<1295530538-sup-6785(a)mail.froschi.org> > Content-Type: text/plain; charset=UTF-8 > > Excerpts from Samuel's message of Thu Jan 20 13:00:24 +0000 2011: >> [...] >> All seem OK except that I get an error with the radius logs. Daloradius >> claims /var/log/radius/radius.log does not exist but it is there. > The user you are running your web application with does not have access > permissions to read the file. > > > Cheers, > > t >

1 0

Re: force_check_config - how to use?
by William Bulley 20 Jan '11

20 Jan '11

According to Alan DeKok <aland(a)deployingradius.com> on Thu, 01/20/11 at 09:23: > > How does the server now that some random module will expand some > random string in the configuration file? > > FYI, it's possible to have "%{...}" in a string which *isn't* > dynamically expanded. I think we are having a misunderstanding here. I don't disagree with what you say above. > > Proper _syntax_ checking > > would have caught this gnarly typo. Discovering the actual problem was > > made more difficult by admins assuming that -XC was more than the above > > described superficial configuration test. Thank you for your repsonses. > > The only way to test run-time expansions is by running packets through > the server. This is true - but this is not my current issue. > If you have a *patch* which helps, great. Until then... You said yourself to not look at the source code. Patches are unlikely in that atmosphere. My point: _syntax_ checking for valid _syntax_ at a time _other_ than run time _is_ _possible_ without having to go the extra mile of semantic checking, as in, variable expansion. I am not talking about variable expansion, since that is only possible by running packets through the server (at run time). Since I am not allowed to inspect the source code, I would not have been able to discover the following comments relevant to this thread: conffile.c - Yep I should learn to use lex & yacc, or at least write a decent parser. conffile.c - FIXME: Add support for ${foo:-bar}, like in xlat.c conffile.c - The parser is getting to be evil. conffile.c - I really really really hate this file. conffile.c - More sanity checking. This is getting to be a horrible hack. conffile.c - yuck... xlat.c - Did I mention that this parser is garbage? If my employer would permit, and if you would allow me to look at the source, I would be happy to supply a patch. Neither of these are likely to happen in any event. This thread was created to shed some light on the issue. I do appreciate your comments. Thanks again. :-) Regards, web... -- William Bulley Email: web(a)umich.edu 72 characters width template ----------------------------------------->|

2 1

Re: force_check_config - how to use?
by William Bulley 20 Jan '11

20 Jan '11

According to Alan DeKok <aland(a)deployingradius.com> on Thu, 01/20/11 at 04:09: > > > > This was changed by an adminstrator to --username=%{mschap:User-Name:-None} > > except that the leading left brace ("{") was omitted... :-( > > That's a run-time expansion. Checking the config won't help. I got that. See below. > > My question: is there any way to parse and check the "value" of the > > ntlm_auth variable in the modules/mschap file for valid syntax? > > No. It can only be checked by running the server. You are partly right. See below. > > It doesn't seem that this ntlm_auth variable was expanded when the config > > file was read. > > It's not. It's expanded at *run time*, when the server receives a packet. True. The variable expansion can only occur at run time. > No. "-XC" succeeding means that the configuration is *superficially* > OK. It's not a substitute for doing functional tests. Clearly. :-) > The ntlm_auth line is expanded at run time, using data taken from the > packet. That is the *only* time that the server can discover an error. > It can't discover the error when it loads the configuration, because > the server core doesn't know which strings should be expanded, and what > data should be put in the expansion. This it true: the ntlm_auth line is expanded at run time. My question in this thread is for the consideration of more throrough _syntax_ checking - without expansion - during the -XC process. Proper _syntax_ checking would have caught this gnarly typo. Discovering the actual problem was made more difficult by admins assuming that -XC was more than the above described superficial configuration test. Thank you for your repsonses. Regards, web... -- William Bulley Email: web(a)umich.edu 72 characters width template ----------------------------------------->|

2 1

ETA for 2.1.11?
by Craig Campbell 20 Jan '11

20 Jan '11

Just wondering when 2.1.11 might be released? I am seeing an issue in 2.1.10 very similar to "FR 2.1.9 Frequent SegFault, didn't happen with FR 2.1.8" (http://freeradius.1045715.n5.nabble.com/FR-2-1-9-Frequent-SegFault-didn-t-h…) I am hoping that the cause might have already been addressed and vanish in 2.1.11. Thanks for all the hard work on freeradius. -craig __________ Information from ESET Smart Security, version of virus signature database 5803 (20110120) __________ The message was checked by ESET Smart Security. http://www.eset.com

2 1

Freeradius2 + Daloradius
by Samuel 20 Jan '11

20 Jan '11

Pardon me if this has been addressed on this forum. Please can someone shed light on what I must have done wrong . I have Freeradius 2 installed on Centos 5.5 with Mysql 5 and added Daloradius 0.9-8 as a frontend. All seem OK except that I get an error with the radius logs. Daloradius claims /var/log/radius/radius.log does not exist but it is there. Dolaradius was looking originally for /var/log/freeradius/radius.log. I have made changes in the ~/library/exten-radius_log.php file to look for /var/log/radius/radius.log yet no success. Has anyone got a solution please ? Thanks Samuel

2 1

Freeradius2 + Daloradius
by Samuel 20 Jan '11

20 Jan '11

Please can someone shed light on what I must have done wrong. I have Freeradius 2 installed on Centos 5.5 with Mysql 5 and added Daloradius 0.9-8 as a frontend. All seem OK except that I get an error with the radius logs. Daloradius claims /var/log/radius/radius.log does not exist but it is there. Dolaradius was looking originally for /var/log/freeradius/radius.log. I have made changes in the ~/library/exten-radius_log.php file to look for /var/log/radius/radius.log yet no success. Has anyone got a solution please ? Thanks Samuel

1 0

Logging Authentication Rejects
by Kristoffer Milligan 20 Jan '11

20 Jan '11

radiusd: FreeRADIUS Version 2.2.0, for host i686-pc-linux-gnu, built on Apr 30 2010 at 09:48:09 root@hostname:~# lsb_release -a Distributor ID: Ubuntu Description: Ubuntu 9.10 Release: 9.10 Codename: karmic Good day list, I am trying to set up some logging on my radius server. The server is responsible for a WiMAX network running on equipment from Alvarion. After a troublesome start, things are starting to straighten out. I've now reached the point where I want to apply some additional logging to start ironing out minor bugs. Running FR in debug mode, I see the occasional access-reject (mostly caused by wrongly configured username/passwords), and I would like to log these to my database. In my default tunnel, I have added sql_log module to the post-auth section, subsection Post-Auth-Type REJECT. The default SQL looks like this: # Post-Auth = "INSERT INTO ${postauth_table} \ # (username, pass, reply, authdate) VALUES \ # ('%{User-Name}', '%{User-Password:-Chap-Password}', \ # '%{reply:Packet-Type}', '%S'); which would provide a line of log (in my case) looking something like this: Incremental Id, =F8=F334534534645645645687(a)WiMAX.com, '', 'Access-Reject', DATETIME. (The username is jus something I typed out, but that's what they look like). This data is good to give me an idea of how many access rejects I am getting, but I have no clue from what usernames they are coming, nor WHY they were rejected. I know that the username in the inner tunnel is plaintext as well, meaning it looks like i.e kristoffer(a)WiMAX.com. My question is; What should my SQL look like if I want to log the following data: Incremental id, 'Attempted/Cleartext Username', 'Attempted/Cleartext password', 'Access-Reject - {Rejection-Reason}', DATETIME ? Looking forwards to your replies.. Sincerely, Kristoffer Milligan

2 1

Re: force_check_config - how to use?
by William Bulley 20 Jan '11

20 Jan '11

According to Alan DeKok <aland(a)deployingradius.com> on Wed, 01/19/11 at 13:57: > > I *think* it's something you can add to a module configuration to > force it to instantiate itself. Normally, when "radiusd -C" is used, > the SQL module is skipped, because checking the config doesn't mean > opening 50 sockets to the SQL server. Adding "force_check_config=yes" > will make modules like SQL instantiate themselves, including opening 50 > sockets to the SQL server. Thanks. I came across this while trying to debug a gnarly situation with the mschap module. The configs in modules/mschap include at the end: #ntlm_auth = "/path/to/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" This was changed by an adminstrator to --username=%{mschap:User-Name:-None} except that the leading left brace ("{") was omitted... :-( The output of radiusd -XC concluded that "Configuration appears to be OK." when in fact mschap authentications could never recover the User-Name when ntlm_auth was given --username=%mschap:User-Name:-None} to deal with... My question: is there any way to parse and check the "value" of the ntlm_auth variable in the modules/mschap file for valid syntax? Inside cf_item_parse() in src/main/conffile.c there is a PW_TYPE_STRING_PTR case of the switch statement. In this case there is the following comment: /* * Expand variables which haven't already been * expanded automagically when the configuration * file was read. */ It doesn't seem that this ntlm_auth variable was expanded when the config file was read. After this comment is an if statement "if (value == dflt)" which, if true, results in a call to cf_expand_variables() passing the above ntlm_auth string value as "value". It appears to me that this if statement will never be true, since the default value for ntlm_auth is NULL, so any string value (right hand side of ntlm_auth variable) will not be NULL, nor will the pointers match. And if they did, what is the purpose of expanding a variable which is NULL? The net result is that the human error (see typo above) was not discovered while configuration checking with -XC which gave a false positive indication. Very confusing... Regards, web... -- William Bulley Email: web(a)umich.edu 72 characters width template ----------------------------------------->|

3 4

Radping Works Wireless fails
by mjonesmcne 20 Jan '11

20 Jan '11

Hi all I am trying to setup freeradius on an OES2 server to authenticate via ldap to edir. I have been following the document freeradius-edir from here http://www.novell.com/coolsolutions/assets/freeradius-edir.pdf , but now i am stuck. Radping works shown as the first login, but wireless fails shown after the broken line. Can anyone shed some light on what might be wrong? Thanks in advance Mark radius2:/home/radius # radiusd -x Starting - reading configuration files ... Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded System Module: Instantiated unix (unix) Module: Loaded LDAP rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x80125f20 Module: Instantiated ldap (ldap) Module: Loaded eap rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap rlm_eap: Loaded and initialized type gtc rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls rlm_eap: Loaded and initialized type ttls rlm_eap: Loaded and initialized type peap rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess Module: Instantiated preprocess (preprocess) Module: Loaded realm Module: Instantiated realm (suffix) Module: Loaded files Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id Module: Instantiated acct_unique (acct_unique) Module: Loaded detail Module: Instantiated detail (detail) Module: Loaded radutmp Module: Instantiated radutmp (radutmp) Initializing the thread pool... Listening on authentication 172.17.152.34:1812 Listening on accounting 172.17.152.34:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.152.0.61:1851, id=27, length=46 User-Name = "mjones" User-Password = "xxxxx" rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. rlm_ldap: - authenticate rlm_ldap: login attempt by "mjones" with password "xxxx" rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: (re)connect to 172.17.152.4:636, authentication 0 rlm_ldap: setting TLS mode to 1 rlm_ldap: setting TLS CACert File to /etc/raddb/certs/rootder.b64 rlm_ldap: setting TLS CACert Directory to /etc/raddb/certs/ rlm_ldap: setting TLS Require Cert to demand rlm_ldap: bind as cn=adm_radius,o=hpsd_48/xxxxx to 172.17.152.4:636 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: user DN: cn=Mjones,o=HPSD_48 rlm_ldap: (re)connect to 172.17.152.4:636, authentication 1 rlm_ldap: setting TLS mode to 1 rlm_ldap: setting TLS CACert File to /etc/raddb/certs/rootder.b64 rlm_ldap: setting TLS CACert Directory to /etc/raddb/certs/ rlm_ldap: setting TLS Require Cert to demand rlm_ldap: bind as cn=Mjones,o=HPSD_48/xxxxx to 172.17.152.4:636 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user mjones authenticated succesfully Login OK: [mjones] (from client xxxxxx port 0) ----------------------------------------------------------------------------------------------------- Sending Access-Accept of id 27 to 10.152.0.61 port 1851 rad_recv: Access-Request packet from host 10.152.0.100:36595, id=29, length=194 NAS-IP-Address = 10.152.0.100 NAS-Port = 0 NAS-Port-Type = Wireless-802.11 User-Name = "mjones" Calling-Station-Id = "0022FA4B4F18" Called-Station-Id = "000B86611894" MS-CHAP-Challenge = 0x31f67b603f85bedb36920a24a8519b6b MS-CHAP2-Response = 0x0700ac3bda3013be2b60fd6c451363cf5b470000000000000000021dd9e1c54f208a9d350faa59da531e667ca8ec1a5678f9 Service-Type = Login-User Aruba-Essid-Name = "HPSD_RAD2" Aruba-Location-Id = "Tech 01" rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. Login incorrect: [mjones] (from client xxxxxx port 0 cli 0022FA4B4F18) rad_recv: Access-Request packet from host 10.152.0.100:36595, id=29, length=194 Sending Access-Reject of id 29 to 10.152.0.100 port 36595 -- View this message in context: http://freeradius.1045715.n5.nabble.com/Radping-Works-Wireless-fails-tp3348… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

None
by Mark Jones 19 Jan '11

19 Jan '11

1 0