March 2011 - Freeradius-Users - lists.freeradius.org

Lastest using git
by David Peterson 10 Mar '11

10 Mar '11

I am trying to recompile any new changes but cannot for the life of me remember how to check out the latest version. I believe it's called "Stable" David

3 3

different perl module in different virtual server result different w/ or w/o -X
by schilling 10 Mar '11

10 Mar '11

Hi All, I am running 2.1.6. I have modules/perl_resnet like perl perl_resnet {...} for virtual server resnet, which will put mac-address in sandbox vlan if not in database. and I have modules/perl_foosecure perl perl_foosecure{...} for virtual server auth used as inner-tunnel for eap, which will put user(a)foo.edu in one of student0[1234] vlan if ldap returns status as student. When I run radiusd -X, user(a)foo.edu will be put in one of student0[1234] every time. But if I run normal radiusd w/o -X flag, user(a)foo.edu will sometimes be put in sandbox vlan, and sometimes be put in one of student0[1234] vlan. [root@auth1 raddb]# perl -V | grep -i multip usethreads=define use5005threads=undef useithreads=define usemultiplicity=define Compile-time options: MULTIPLICITY PERL_IMPLICIT_CONTEXT Any insight? Schilling

1 0

CHAP problem with PPPoE server
by Paul Thornton 09 Mar '11

09 Mar '11

Hi List, I've got a problem which I now know isn't FreeRADIUS misbehaving but seems to be some CHAP-related issue, but I can't see what. With advanced apologies for being somewhat off-topic, I'm wondering if anyone has any ideas? I've been building a test PPPoE server on Linux, specifically CentOS 5.5 with pppd 2.4.4 (also tried 2.4.5) and freeradius-client 1.1.6. PPPoE provided by rp-pppoe-3.10. The server is FreeRADIUS 1.1.7 which I know is a bit old, but this is in use as a production machine and authenticates a lot of PPP and interactive login requests without any trouble so hasn't been upgraded for a while. In my test setup, all attempts to use CHAP or MSCHAP-v2 for authentication fail, basically because there is no CHAP challenge or password sent with the Access-Request. Not unreasonably, the radius server rejects the request: rad_recv: Access-Request packet from host 217.65.165.176:43606, id=160, length=54 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "paultest" NAS-IP-Address = 217.65.165.176 NAS-Port = 0 ... auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Login incorrect: [paultest/<no User-Password attribute>] (from client vttest02 port 0) I've also set up a FreeBSD PPPoE server to check that this wasn't a client-side problem; currently I'm using a Mac OS X client but it also fails using Windows or a Cisco client. It works OK with the FreeBSD server - hence the statement about knowing it isn't a FreeRADIUS issue: rad_recv: Access-Request packet from host 217.65.165.171:50582, id=224, length=180 User-Name = "paultest" Service-Type = Framed-User Framed-Protocol = PPP MS-CHAP-Challenge = 0x33323733383637393730323730333033 MS-CHAP2-Response = 0x0100b2a9c9bdfa3458c17851fd4170fb83ad0000000000000000967b707a1f73c2fa39c936a671ed4e01beb4c9744466c88e NAS-IP-Address = 217.65.165.171 NAS-Identifier = "build1" Calling-Station-Id = "7c:6d:62:90:36:55" NAS-Port-Type = Ethernet NAS-Port = 12 ... Login OK: [paultest] (from client vttest01 port 12 cli 7c:6d:62:90:36:55) Clearly the difference is in the challenge - but I'm at a loss to understand why this wouldn't "just work" with RADIUS. The pppd logs suggest that it is using CHAP, but it doesn't think that letting the RADIUS server have the challenge is important... Has anyone had a similar problem or can suggest anything? I've been going around in circles here all day and ended up going nowhere. Many thanks, Paul.

3 4

How to stop at pre-proxy python module with Access-Request
by Ranjith T 09 Mar '11

09 Mar '11

Hi, I am using freeradius 2.1.10 and python modules at different stages(pre-proxy, post-proxy) of my RADIUS server which is running in proxy mode. >From the python pre-proxy module I am able to return "radiusd.RLM_MODULE_HANDLED" which is handled at pre-proxy section of the file "sites-available/default". I want the server to stop at "HANDLED" and send back "Access-Accept" back to the requested client from pre-proxy once the return is HANDLED. Can anyone point to me how to achieve this? The following is what I have tried. My problem is that: if I configure "ok" from "if (handled) {" part of the pre-proxy, the server proceeds with sending this request to external RADIUS server for Authentication(looks like normal behavior with module returning OK ) and if I return "handled" from "if(handled) {" part, then the server gives the following, (Same behavior is observed with setting "handled = return" inside "python{}" module.) Ready to process requests. rad_recv: Access-Request packet from host 72.163.210.89 port 2051, id=96, length=104 User-Name = "ranjith" User-Password = "test123" # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "ranjith", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "ranjith" [suffix] Adding Realm = "NULL" [suffix] Proxying request from user ranjith to realm NULL [suffix] Preparing to proxy authentication request to realm "NULL" ++[suffix] returns updated [eap] No EAP-Message, not doing EAP ++[eap] returns noop *** I am in authorize!!!!!!!!!!!!!!!!!! *** *** radlog call in authorize *** ++[python] returns ok ++? if (handled) ? Evaluating (handled) -> FALSE ++? if (handled) -> FALSE ++[files] returns noop [sql] expand: %{User-Name} -> ranjith [sql] sql_set_user escaped user --> 'ranjith' rlm_sql (sql): Reserving sql socket id: 1 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'ranjith' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'ranjith' ORDER BY priority rlm_sql (sql): Released sql socket id: 1 [sql] User ranjith not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop # Executing section pre-proxy from file /etc/raddb/sites-enabled/default +- entering group pre-proxy {...} *** radlog call in pre_proxy_ranjith !!!!!!!!!!!!!!!*** *** pre_proxy_ranjith Found Session !!!!!!!!!!!!! *** ++[python] returns handled ++? if (handled) ? Evaluating (handled) -> TRUE ++? if (handled) -> TRUE ++- entering if (handled) {...} +++[handled] returns handled ++- if (handled) returns handled There was no response configured: rejecting request 1 Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> ranjith attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 94 to 72.163.210.89 port 2010 Waking up in 4.9 seconds. Cleaning up request 1 ID 94 with timestamp +19 Ready to process requests. The following is the snippet of the "sites-available/default" pre-proxy section. pre-proxy { # attr_rewrite # Uncomment the following line if you want to change attributes # as defined in the preproxy_users file. # files # Uncomment the following line if you want to filter requests # sent to remote servers based on the rules defined in the # 'attrs.pre-proxy' file. # attr_filter.pre-proxy # If you want to have a log of packets proxied to a home # server, un-comment the following line, and the # 'detail pre_proxy_log' section, above. # pre_proxy_log #python python { notfound = 1 noop = 2 ok = 3 updated = 4 fail = return reject = return userlock = return invalid = return handled = 3 #handled = return #ok = return } if (handled) { #Post-Auth-Type = Access-Accept #Response-Packet-Type = Access-Accept #handled ok } } The following is the snippet of the "sites-available/default" authenticate section(added python module). authenticate { # # PAP authentication, when a back-end database listed # in the 'authorize' section supplies a password. The # password can be clear-text, or encrypted. Auth-Type PAP { pap } # # Most people want CHAP authentication # A back-end database listed in the 'authorize' section # MUST supply a CLEAR TEXT password. Encrypted passwords # won't work. Auth-Type CHAP { chap } # # MSCHAP authentication. Auth-Type MS-CHAP { mschap } # # If you have a Cisco SIP server authenticating against # FreeRADIUS, uncomment the following line, and the 'digest' # line in the 'authorize' section. digest # # Pluggable Authentication Modules. # pam # # See 'man getpwent' for information on how the 'unix' # module checks the users password. Note that packets # containing CHAP-Password attributes CANNOT be authenticated # against /etc/passwd! See the FAQ for details. # # For normal "crypt" authentication, the "pap" module should # be used instead of the "unix" module. The "unix" module should # be used for authentication ONLY for compatibility with legacy # FreeRADIUS configurations. # unix python #python { #This doesn't work #ok = handled #} # Uncomment it if you want to use ldap for authentication # # Note that this means "check plain-text password against # the ldap database", which means that EAP won't work, # as it does not supply a plain-text password. # Auth-Type LDAP { # ldap # } # # Allow EAP authentication. eap # # The older configurations sent a number of attributes in # Access-Challenge packets, which wasn't strictly correct. # If you want to filter out these attributes, uncomment # the following lines. # # Auth-Type eap { # eap { # handled = 1 # } # if (handled && (Response-Packet-Type == Access-Challenge)) { # attr_filter.access_challenge.post-auth # handled # override the "updated" code from attr_filter # } # } } Thanks Ranjith T

2 1

Freeradius dies...
by Etienne Pretorius 09 Mar '11

09 Mar '11

Hello All, Can anyone make sense of this for me? ASSERT FAILED event.c[1181]: "We do not have threads, but the request is marked as queued or running in a child thread" == NULL I have 3 detail instances and 3 detail listeners proxying the detail file to 3 servers. I have at the same time the COA server sample modified for packets-of-disconnects The COA server is suppose to fail since this server is not production yet, and after its 3rd attempt the above error message appears. Detail listener /var/log/freeradius/radacct/server0/detail-* state running signalled 0 waiting 1.139005 sec Waking up in 0.3 seconds. Detail listener /var/log/freeradius/radacct/server1/detail-* state running signalled 0 waiting 0.940611 sec Waking up in 0.2 seconds. Detail listener /var/log/freeradius/radacct/server2/detail-* state running signalled 0 waiting 0.822329 sec Waking up in 0.5 seconds. Detail listener /var/log/freeradius/radacct/server0/detail-* state running signalled 0 waiting 0.864066 sec Waking up in 0.1 seconds. Detail listener /var/log/freeradius/radacct/server1/detail-* state running signalled 0 waiting 1.007105 sec Detail listener /var/log/freeradius/radacct/server2/detail-* state running signalled 0 waiting 1.219968 sec Waking up in 0.3 seconds. Sending Disconnect-Request of id 246 to 196.43.3.86 port 1700 User-Name = "protected@address" NAS-IP-Address = 196.43.27.72 Framed-IP-Address = 41.240.31.186 X-Ascend-Session-Svr-Key = "D9144C7B" Waking up in 0.2 seconds. Detail listener /var/log/freeradius/radacct/server0/detail-* state running signalled 0 waiting 1.214130 sec Waking up in 0.2 seconds. ASSERT FAILED event.c[1181]: "We do not have threads, but the request is marked as queued or running in a child thread" == NULL Aborted ;========== freeradius: FreeRADIUS Version 2.1.10, for host i486-pc-linux-gnu, built on Nov 14 2010 at 20:41:03 Copyright (C) 1999-2010 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. ;========= Using Debian Linux. Kind Regards, Etienne Pretorius

2 2

Secondary LDAP server
by McNutt, Justin M. 09 Mar '11

09 Mar '11

One of my virtual servers uses LDAP auth. However, it isn't clear to me if modules/ldap can be configured with a secondary LDAP server, should the primary fail to respond. The group that provides the LDAP server can't set up multiple servers behind a load balancer due to cert issues, so I'm looking for a way to add a failover LDAP server to the RADIUS configuration. What's the easiest/best/recommended way to do something like this? Can modules/ldap be configured this way, or should I create a modules/ldap2 (or similar) and call it somehow? Suggestions welcome. Thanks! Justin McNutt Network Systems Analyst - Ninja DNPS, Mizzou Telecom (573) 882-5183 "Do you have a concussion?" Ping is NOT a service. You don't need it. Use a real test.

4 4

RE: Hopefully quick question: conditional processing sneaking in and setting Auth-Type
by Gary Gatten 08 Mar '11

08 Mar '11

So.... Still not sure what file is tweaking this. I ended up copying the entire /raddb dir from ServerB to ServerA to get the same exact behavior. Prior to that I tried. Replicating (copying the file via ftp): radiusd.conf, users, default, inner-tunnel, radiusd, ... maybe more. I also manually diff'd: chap, mschap, pap, hints, huntgroups, ...maybe more.... Is there additional radiusd args I can use to see what module/file/etc is executing the conditional processing? ... [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop # Begin output of goofy processing ++? if (!control:Auth-Type) ? Evaluating !(control:Auth-Type) -> FALSE ++? if (!control:Auth-Type) -> FALSE # End output of goofy processing Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} ... I'll be more than happy to sanitize numerous pages of radiusd -X output from both servers, but I captured and diff'd those and accounted for all diffs from the startup process. As noted, I also replicated the most common conf files that I probably tweaked. Weird... Thanks! Gary -----Original Message----- From: Gary Gatten Sent: Saturday, March 05, 2011 9:17 AM To: 'freeradius-users(a)lists.freeradius.org' Subject: Re: Hopefully quick question: conditional processing sneaking in and setting Auth-Type Yeah, when I wrote the email I figured I'd get at least one reply like that. I was hoping the position/sequence of the event would be enough to point me in he right direction. I'll capture the startups and auth requests / replies from both servers. In the mean time I'm thinking the mschap module on the failing server isn't quite right. Both have changes that are commented out, but who knows, maybe I missed something. I think it (failing) might be a slightly older version than the other as well. ----- Original Message ----- From: Alan DeKok [mailto:aland@deployingradius.com] Sent: Saturday, March 05, 2011 12:38 AM To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Hopefully quick question: conditional processing sneaking in and setting Auth-Type Gary Gatten wrote: > I can't find where this conditional processing is happing. I have two > FR servers with "nearly" the same config. Auth works on one, but not > the other: Posting 2-3 lines of debug output doesn't help. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

2 3

EAP-TLS with Windows CA and CRL for Wireless Auth
by Rudolph Bott 08 Mar '11

08 Mar '11

Hi List, I've successfully setup the following scenario: - Windows CA (Root-CA and Sub-CA) - Cisco WLAN Controller + APs - Windows 7 Domain Clients (+ Computer Certificates) - EAP-TLS Auth with certificates I created a small script to fetch the CRL from the CA and have it converted to PEM format: -- snip -- #!/bin/bash ID=$$ wget http://ca.host.name/CA.crl -O /tmp/CA.$ID.crl -q if [ $? -eq 0 ] then openssl crl -in /tmp/CA.$ID.crl -inform DER -out /etc/raddb/certs/crl.pem -outform PEM rm /tmp/CA.$ID.crl c_rehash /etc/raddb/certs/ > /dev/null fi -- snip -- c_reheash seems to work since I have the Symlinks in /etc/raddb/certs/. The relevant parameters in eap.conf are set: check_crl = yes CA_path = ${certdir}/ However, as long as check_crl is set to 'yes', the following happens when a client tries to connect: Tue Mar 8 13:09:48 2011 : Info: Found Auth-Type = EAP Tue Mar 8 13:09:48 2011 : Info: # Executing group from file /etc/raddb/sites-enabled/default Tue Mar 8 13:09:48 2011 : Info: +- entering group authenticate {...} Tue Mar 8 13:09:48 2011 : Info: [eap] Request found, released from the list Tue Mar 8 13:09:48 2011 : Info: [eap] EAP/tls Tue Mar 8 13:09:48 2011 : Info: [eap] processing type tls Tue Mar 8 13:09:48 2011 : Info: [tls] Authenticate Tue Mar 8 13:09:48 2011 : Info: [tls] processing EAP-TLS Tue Mar 8 13:09:48 2011 : Info: [tls] eaptls_verify returned 7 Tue Mar 8 13:09:48 2011 : Info: [tls] Done initial handshake Tue Mar 8 13:09:48 2011 : Info: [tls] <<< TLS 1.0 Handshake [length 0a35], Certificate Tue Mar 8 13:09:48 2011 : Error: --> verify error:num=36:unhandled critical CRL extension Tue Mar 8 13:09:48 2011 : Info: [tls] >>> TLS 1.0 Alert [length 0002], fatal certificate_unknown Tue Mar 8 13:09:48 2011 : Error: TLS Alert write:fatal:certificate unknown Tue Mar 8 13:09:48 2011 : Error: TLS_accept: error in SSLv3 read client certificate B Tue Mar 8 13:09:48 2011 : Error: rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned Tue Mar 8 13:09:48 2011 : Error: SSL: SSL_read failed in a system call (-1), TLS session fails. Tue Mar 8 13:09:48 2011 : Debug: TLS receive handshake failed during operation Tue Mar 8 13:09:48 2011 : Info: [tls] eaptls_process returned 4 Tue Mar 8 13:09:48 2011 : Info: [eap] Handler failed in EAP/tls Tue Mar 8 13:09:48 2011 : Info: [eap] Failed in EAP select Tue Mar 8 13:09:48 2011 : Info: ++[eap] returns invalid Tue Mar 8 13:09:48 2011 : Info: Failed to authenticate the user. Tue Mar 8 13:09:48 2011 : Auth: Login incorrect (unhandled critical CRL extension): [host/CLIENT123.domain/<via Auth-Type = EAP>] (from client WLAN-TEST port 1 cli 00-24-d7-8a-53-cc) Tue Mar 8 13:09:48 2011 : Info: Using Post-Auth-Type Reject Tue Mar 8 13:09:48 2011 : Info: # Executing group from file /etc/raddb/sites-enabled/default Tue Mar 8 13:09:48 2011 : Info: +- entering group REJECT {...} Tue Mar 8 13:09:48 2011 : Info: [attr_filter.access_reject] expand: %{User-Name} -> host/CLIENT123.domain Tue Mar 8 13:09:48 2011 : Debug: attr_filter: Matched entry DEFAULT at line 11 Tue Mar 8 13:09:48 2011 : Info: ++[attr_filter.access_reject] returns updated Tue Mar 8 13:09:48 2011 : Info: Delaying reject of request 15 for 1 seconds Tue Mar 8 13:09:48 2011 : Debug: Going to the next request Tue Mar 8 13:09:48 2011 : Debug: Waking up in 0.9 seconds. Tue Mar 8 13:09:49 2011 : Info: Sending delayed reject for request 15 Sending Access-Reject of id 228 to 10.70.11.15 port 32768 EAP-Message = 0x04090004 Message-Authenticator = 0x00000000000000000000000000000000 When I disable CRL checks, everything works fine again. Does anybody have any experience with implementing Windows based CRLs in Freeradius? Radius Version is: radiusd: FreeRADIUS Version 2.1.10, for host i686-suse-linux-gnu, built on Mar 5 2011 at 17:06:42 running on SLES 11 (compiled from source as RPM package) Any kind of advice would be appreciated! -- Mit freundlichen Grüßen/With Kind Regards Rudolph Bott

2 2

freeRadius/LDAP per NAS access
by Guy 08 Mar '11

08 Mar '11

Hi all, I now have FreeRadius granting access and using LDAP for username and password information. My next challenge, using the same Radius and LDAP server I would like to grant different users access via different NAS clients. eg in LDAP I would have: uid=guy services: VPN services: WiFi If I have the "services: VPN" then I would be allowed to connect to the VPN server and if I don't have that entry in my LDIF then it would not be allowed to access. Any ideas on how to do this, simply? Thanks ---Guy

2 2

Cannot add (dynamic) client
by Jan Strauch 08 Mar '11

08 Mar '11

2 1