August 2011 - Freeradius-Users - lists.freeradius.org

Fwd: Authentication failure issue
by fieldpeak 05 Aug '11

05 Aug '11

Hello Friends, I met a issue regarding password/authentication with FreeRadius, Could anybody help for the issue, Thanks! User-Password = "?\210\365@\263\t\306\343\243iT?\311C\t\002" [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user The details in below mails. Regards, Charles Forwarded conversation Subject: Authentication failure issue ------------------------ From: *fieldpeak* <fieldpeak(a)gmail.com> Date: 2011/8/4 To: freeradius-users(a)lists.freeradius.org Dear Friends, I'm trying integrate Freeswitch with Freeradius, I met below issue, can anyone help, thanks in adance. Freeradius server log: rad_recv: Access-Request packet from host 127.0.0.1 port 52684, id=49, length=111 User-Name = "1001" User-Password = "?\210\365@\263\t\306\343\243iT?\311C\t\002" Called-Station-Id = "888" h323-conf-id = "749d2b5a-16ad-48e4-af58- 24011949d1b5" Calling-Station-Id = "1001" NAS-Port = 0 NAS-IP-Address = 127.0.0.1 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/127.0.0.1/auth-detail-20110803 [auth_log] /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/127.0.0.1/auth-detail-20110803 [auth_log] expand: %t -> Wed Aug 3 12:06:33 2011 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "1001", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop [sql] expand: %{User-Name} -> 1001 [sql] sql_set_user escaped user --> '1001' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '1001' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '1001' ORDER BY priority rlm_sql (sql): Released sql socket id: 4 [sql] User 1001 not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! Using Post-Auth-Type Reject # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> 1001 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 8 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 8 Sending Access-Reject of id 49 to 127.0.0.1 port 52684 Waking up in 4.9 seconds. Cleaning up request 8 ID 49 with timestamp +7674 Ready to process requests. WARNING! No "known good" password found for the user Regards, Charles ---------- From: *fieldpeak* <fieldpeak(a)gmail.com> Date: 2011/8/4 To: freeradius-users(a)lists.freeradius.org Hello Gurus, I've double checked the shared secret on both server and NAS are the same, the problem still exist, it trouble me a few days, can anyone kindly help? nas: /usr/local/etc/radiusclient/servers localhost/localhost testing123 server: /usr/local/etc/raddb/clients.conf secret = testing123

3 7

num_answers_to_alive
by Stefan Winter 04 Aug '11

04 Aug '11

Hi, the configuration of 2.1.10 has the parameter num_answers_to_alive in proxy.conf. Looking at the source code, I found that instead, in realms.c, the config option num_pings_to_alive is used. num_answers is read from the config, but never referenced. If that's the case, then the config option in proxy.conf should be changed to be num_pings_to_alive, otherwise people will likely fail to tweak the value. Speaking of tweaking the value, I also found if (home->num_pings_to_alive < 3) home->num_pings_to_alive = 3; if (home->num_pings_to_alive > 10) home->num_pings_to_alive = 10; The documentation says that 3..10 are *useful* ranges, but doesn't mention that everything else is forbidden. In particular, I would like to use 1, not 3. The idea is: the server was dead before, but now it managed to send a reply back - so it must have been fixed. I would like to mark it alive immediately. Is that unreasonable? Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

4 3

Virtual Servers, the Realms Module, and Proxying
by Jacob Dawson 04 Aug '11

04 Aug '11

Our goal here is to use a variety of virtual servers in our FreeRADIUS instance to allow us to isolate handling of a variety of different sorts of users. As such, there's a fair bit of proxying going on, but much is just going to the virtual servers, and we'd like to be able to use the behavior of the realms module to make this work for us. Unfortunately, I haven't seen any way to get some of those attributes that the Realm module inserts to continue through after being proxied, as they're 'internal' attributes and not wire attributes. I'd like for the Stripped-User-Name and Realm attributes to be available to the far side of the proxy (so I send it from the default virtual server to, say, the generic_realm virtual server), so that it can make decisions based on that information. I obviously can't use the realms module for parsing again in the first layer of virtual server, as I'll just end up creating a loopback on itself, but at the same time, I'd like to avoid having to do all that parsing and thinking in unlang. Since there seems to be some special config for virtual servers, is there any way to achieve this behavior (not stripping the 'internal' attributes when proxying to virtual servers) without a patch? It seems to be consistent with the idea behind virtual servers, but I may be misinterpreting it. Thoughts? I feel like we're trying a little too hard to get what we want, here, but I'm not seeing how to do it the 'right' way. Jacob M. Dawson Network Research Engineer Virginia Tech --- For context: I have an arbitrary number of FreeRADIUS servers providing my AAA service. I have an arbitrary number of NASs all talking to the FreeRADIUS servers, and they all provide the same suite of services to all possible users, so I can't do this proxying based on what client it comes in on (like this page suggests: http://freeradius.org/features/virtual_servers.html) My realm module is short and sweet: realm suffix { format = suffix delimiter = "@" ignore_null = yes } realm prefix { format = prefix delimiter = "\\" } I have the following virtual servers linked in sites-enabled: ad.vt.edu default ed.vt.edu generic-realm proxy-inner-tunnel ad.vt.edu is to handle our Domain users ed.vt.edu is to handle folks authenticating against our Enterprise Directory default is, of course, where they come in to start with generic-realm is intended to handle people who come in with SOME non-vt realm. Could be guests (authenticated against our AAA-related database, access via the sql module), could be eduroam folks. proxy-inner-tunnel is used largely by the ad.vt.edu module to handle proxying the MS-CHAPv2 part of PEAP to our IAS machines. default is simple: authorize { update request{ User-Name := "%{tolower:%{User-Name}}" } preprocess auth_log chap mschap perl suffix prefix eap { ok = return } expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } ldap eap } <other stanzas don't seem relevant> In proxy, we defined these home_servers: home_server ed.vt.edu { type = auth ipaddr = 127.0.0.1 port = 1816 secret = <redacted> } home_server ad.vt.edu { type = auth ipaddr = 127.0.0.1 port = 1815 secret = <redacted> } home_server generic_realm { type = auth ipaddr = 127.0.0.1 port = 1817 secret = <redacted> } home_server_pool ad_virtual_pool { home_server = ad.vt.edu } home_server_pool ed_virtual_pool { home_server = ed.vt.edu } home_server_pool generic_virtual_pool { home_server = generic_realm } realm "~HOKIES" { auth_pool = ad_virtual_pool nostrip } realm "DomainUser" { auth_pool = HOKIES_authen nostrip } realm "~.*w2k\\.vt\\.edu$" { auth_pool = ad_virtual_pool nostrip } realm "~vt.edu$" { auth_pool = ed_virtual_pool } realm LOCAL { } realm NULL { auth_pool = ed_virtual_pool } realm DEFAULT { auth_pool = generic_virtual_pool } Our virtual servers then start off like this, and then include the usual appropriate stanzas: listen { ipaddr = 127.0.0.1 port = 1815 type = auth } client 127.0.0.1 { secret = <redacted> }

3 3

Help: There is a way to make radius let all clients autenticate?
by Rodrigo Yoshioka 04 Aug '11

04 Aug '11

Hi Friends, I'd like some help with the following situation:- I have an infraestruture with about 2.000 clients, autenticating on a radius server, which is fed by an third-part CRM. Although the radius is working to autenticating people, it isn´t having the expected performance. Due to that We will change hardware and software, but we have to do this in a produce environment. In order to avoid trouble and get a lot of clients not autenticating, during the process of changes, there is a way to make radius allow all clients autenticate with a default bandwidth and configuration, but not checking MAC or username and password? Thanks

2 1

Forwarding Accounting Packets
by Tonna, Andrew, VF-MT 04 Aug '11

04 Aug '11

Hi I am trying to set up the radius server so that it forwards all accounting packet to a remote radius server without having to wait for reply. I set it up using the copy-acct-to-home-server, proxy.conf and detail files in the modules directory. I've got one problem however, whenever the remote radius server becomes unavailable and then comes back up, my radius server stop forwarding and never marks it as alive again. At this point the remote server is marked as zombie, and remains marked as zombie indefinitely, even when it becomes reachable. I am using FreeRadius 2.1.7 with the following parameters for the home server in the proxy.conf file: response_window = 8 zombie_period = 40 revive_interval = 120 status_check = none With these parameters I'm understanding that if the local radius server doesn't receive an accounting response from the remote server before 8 seconds then it will mark it as a zombie, after a further 40 seconds it should mark it as dead. Then after 120 seconds it should mark it alive again, however I never see it being marked as alive again. Is there something I'm doing wrong? Or an alternate option? Thanks and regards, Andrew ------------------------------------------------------------------------------------- Vodafone ------------------------------------------------------------------------------------- This email is intended only for the use of individuals to whom it is addressed, as it may contain confidential or privileged information. If you are not a named addressee, intended recipient, or the person responsible for delivering the message to the named addressee, be advised that you have received this email in error and that you should not disseminate, distribute, print, copy this mail or otherwise divulge its contents. In such instances, please notify Vodafone Malta Limited on telephone number +356 99999247 and delete this email from your system. Since this transmission was affected via email, Vodafone Malta Limited cannot guarantee that it is secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. Vodafone Malta Limited does not accept liability for any errors or omissions in the contents of this message which arise as a result of email transmission. Save the environment for our children - Print e-mail only when necessary.

4 7

Change my submission
by aceror 04 Aug '11

04 Aug '11

I will like to receive individuals email from this list but how??

3 2

Implementing SQL Insert/logging for SoH.
by Palmer J.D.F. 04 Aug '11

04 Aug '11

Hi, Further to my last foray onto the list regarding SoH, I'm looking to commit the returned SoH info to the radius database using FreeRADIUS' sql connection. I could be well off target here, but please humour me, so far I have... Created a table 'radsoh', and declared this inside sql.conf. Added a query (soh_query) to dialup.conf, at present this simply just inserts User-Name to the table. Declared soh_query in rlm_sql/conf.h Declared soh_query in the 'module_config' section of rlm_sql.c Declared a function, rlm_sql_soh, which is essentially a copy of rlm_sql_postauth into rlm_sql.c. Added rlm_sql_soh to the export section of rlm_sql.c. It compiles and runs, but here is where I run out of ideas. Presuming I'm on the right track, what else is required to enable the query, and how would I make the call to execute the query? Ideally the call should be made from the with SoH virtual server defined in raddb/sites-enabled. Thanks, Jezz. Jezz Palmer Information Services and Systems Swansea University Singleton Park Swansea SA2 8PP

3 7

rml_perl is not adding attributes to Access-accept
by Igor Xpinha 03 Aug '11

03 Aug '11

I'm new to FreeRADIUS and was initially exploring simple things, such as add attributes to an Access-Accept message. My problem is that the perl script is not being able to access (ie print) values from RAD_REQUEST nor add pairs to RAD_REPLY. The following script: *********** start of example.pl script *********** # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA # # Copyright 2002 The FreeRADIUS server project # Copyright 2002 Boian Jordanov <bjordanov(a)orbitel.bg> # # # Example code for use with rlm_perl # # You can use every module that comes with your perl distribution! # # If you are using DBI and do some queries to DB, please be sure to # use the CLONE function to initialize the DBI connection to DB. # use strict; # use ... # This is very important ! Without this script will not get the filled hashesh from main. use vars qw(%RAD_REQUEST %RAD_REPLY %RAD_CHECK); #use Data::Dumper; # This is hash wich hold original request from radius my %RAD_REQUEST; # In this hash you add values that will be returned to NAS. my %RAD_REPLY; #This is for check items my %RAD_CHECK; # # This the remapping of return values # use constant RLM_MODULE_REJECT=> 0;# /* immediately reject the request */ use constant RLM_MODULE_FAIL=> 1;# /* module failed, don't reply */ use constant RLM_MODULE_OK=> 2;# /* the module is OK, continue */ use constant RLM_MODULE_HANDLED=> 3;# /* the module handled the request, so stop. */ use constant RLM_MODULE_INVALID=> 4;# /* the module considers the request invalid. */ use constant RLM_MODULE_USERLOCK=> 5;# /* reject the request (user is locked out) */ use constant RLM_MODULE_NOTFOUND=> 6;# /* user not found */ use constant RLM_MODULE_NOOP=> 7;# /* module succeeded without doing anything */ use constant RLM_MODULE_UPDATED=> 8;# /* OK (pairs modified) */ use constant RLM_MODULE_NUMCODES=> 9;# /* How many return codes there are */ # Function to handle authorize sub authorize { # For debugging purposes only &log_request_attributes; # Here's where your authorization code comes # You can call another function from here: &test_call; return RLM_MODULE_OK; } # Function to handle authenticate sub authenticate { # For debugging purposes only &log_request_attributes; print "***** testing auth\n"; print $RAD_REQUEST{'User-Name'}; print "\n ******\n"; if ($RAD_REQUEST{'User-Name'} =~ /^baduser/i) { # Reject user and tell him why $RAD_REPLY{'Reply-Message'} = "Denied access by rlm_perl function"; return RLM_MODULE_REJECT; } else { # Accept user and set some attribute $RAD_REPLY{'h323-credit-amount'} = "100"; return RLM_MODULE_OK; } # Accept user and set some attribute $RAD_REPLY{'h323-credit-amount'} = "100"; return RLM_MODULE_OK; } # Function to handle preacct sub preacct { # For debugging purposes only &log_request_attributes; return RLM_MODULE_OK; } # Function to handle accounting sub accounting { print "***** accounting\n"; # For debugging purposes only &log_request_attributes; # You can call another subroutine from here &test_call; return RLM_MODULE_OK; } sub accounting_start { print "***** accounting_start\n"; return RLM_MODULE_OK; } sub accounting_stop { print "***** accounting_stop\n"; return RLM_MODULE_OK; } # Function to handle checksimul sub checksimul { # For debugging purposes only &log_request_attributes; return RLM_MODULE_OK; } # Function to handle pre_proxy sub pre_proxy { # For debugging purposes only &log_request_attributes; return RLM_MODULE_OK; } # Function to handle post_proxy sub post_proxy { # For debugging purposes only &log_request_attributes; return RLM_MODULE_OK; } # Function to handle post_auth sub post_auth { # For debugging purposes only &log_request_attributes; return RLM_MODULE_OK; } # Function to handle xlat sub xlat { # For debugging purposes only &log_request_attributes; # Loads some external perl and evaluate it my ($filename,$a,$b,$c,$d) = @_; &radiusd::radlog(1, "From xlat $filename "); &radiusd::radlog(1,"From xlat $a $b $c $d "); local *FH; open FH, $filename or die "open '$filename' $!"; local($/) = undef; my $sub = <FH>; close FH; my $eval = qq{ sub handler{ $sub;} }; eval $eval; eval {main->handler;}; } # Function to handle detach sub detach { # For debugging purposes only &log_request_attributes; # Do some logging. &radiusd::radlog(0,"rlm_perl::Detaching. Reloading. Done."); } # # Some functions that can be called from other functions # sub test_call { # Some code goes here &radiusd::radlog(1, "Auth: RAD_REQUEST: $_ = $RAD_REQUEST{$_}"); } sub log_request_attributes { # This shouldn't be done in production environments! # This is only meant for debugging! for (keys %RAD_REQUEST) { &radiusd::radlog(1, "RAD_REQUEST: $_ = $RAD_REQUEST{$_}"); } } *********** end of example.pl script *********** with freeradius -X i get: ****** start of debugging info ****** rlm_perl: Auth: RAD_REQUEST: = rlm_perl: Added pair NAS-Port-Type = Virtual rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Calling-Station-Id = XXXXXXXX rlm_perl: Added pair Called-Station-Id = XXXXXXXXXX rlm_perl: Added pair X-Ascend-Send-Auth = Send-Auth-PAP rlm_perl: Added pair Framed-Protocol = GPRS-PDP-Context rlm_perl: Added pair User-Name = XXXXXXXXXXXX rlm_perl: Added pair User-Password = 1z1z1z rlm_perl: Added pair NAS-IP-Address = 192.168.18.1 rlm_perl: Added pair NAS-Port = 60000 rlm_perl: Added pair NAS-Port-Id = GGSN rlm_perl: Added pair Auth-Type = Perl ++[perl] returns ok Found Auth-Type = Perl # Executing group from file /etc/freeradius/sites-enabled/default +- entering group Perl {...} ***** testing auth ****** rlm_perl: Added pair NAS-Port-Type = Virtual rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Called-Station-Id = XXXXXXXXX rlm_perl: Added pair Calling-Station-Id = XXXXXXXXXXX rlm_perl: Added pair X-Ascend-Send-Auth = Send-Auth-PAP rlm_perl: Added pair Framed-Protocol = GPRS-PDP-Context rlm_perl: Added pair User-Name = XXXXXXXX rlm_perl: Added pair User-Password = XXXXXXXX rlm_perl: Added pair NAS-Port = 60000 rlm_perl: Added pair NAS-IP-Address = 192.168.18.1 rlm_perl: Added pair NAS-Port-Id = GGSN rlm_perl: Added pair Auth-Type = Perl ++[perl] returns ok # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 60 to 192.168.18.1 port 1645 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 60 with timestamp +9 Ready to process requests. ****** end of debugging info ****** What I was expecting? I was expecting that the Access-Accept would have printed: print "***** testing auth\n"; print $RAD_REQUEST{'User-Name'}; print "\n ******\n"; But, as you see, it only printed: print "***** testing auth\n"; print "\n ******\n"; I was also expecting the Access-Accept to have: $RAD_REPLY{'h323-credit-amount'} = "100"; return RLM_MODULE_OK; But... it didn't happen as you can see. Version of FreeRADIUS: Tue Aug 2 16:55:46 2011 : Info: FreeRADIUS Version 2.1.10, for host x86_64-pc-linux-gnu, built on Nov 14 2010 at 21:12:30 Perl version: This is perl, v5.10.1 (*) built for x86_64-linux-gnu-thread-multi PS: I was able with users to add the desired attributes. Thank you for any help and best regards, FishSemXpinha

2 1

segmentation fault freeradius 2.1.7 using rlm_sql
by Amir Tal 03 Aug '11

03 Aug '11

Hi all, freeRADIUS version 2.1.7 (package freeradius2 on centos 5.6) Radius is configured to store user info (auth) in ldap - running on same machine as freeradius, and use rlm_sql for accounting info (and simultaneous use checks) - running on remote machine. For some unknown reason radiusd keeps getting segmentation faults, every few days and even after several hours of work. Jul 27 04:01:03 RADIUS4 kernel: radiusd[29903]: segfault at 00000000000000c8 rip 00002aef39fb9cfb rsp 00000000456d6170 error 4 Last lines in the radius.log : [sql] expand: UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}' -> UPDATE radacct SET acctstoptime = '2011-07-27 04:01:03', acctsessiontime = '0', acctinputoctets = '0' << 32 | '0', acctoutputoctets = '0' << 32 | [sql] expand: /var/log/radius/sqltrace.sql -> /var/log/radius/sqltrace.sql rlm_sql (sql): Trying to (re)connect unconnected handle 12.. rlm_sql (sql): Attempting to connect rlm_sql_mysql #12 since configuration files are quite large, I didn't attach complete dump or radius -X , let me know what other info is needed. Regards, Amir Tal.

7 13

Re: Error: User-Name is not the same as MS-CHAP name
by broo0ose＠googlemail.com 03 Aug '11

03 Aug '11

Hi, I seem to have the same issue as described in this thread, I also have XP/Novell legacy clients, and I want to move to AD from eDir. Re: Error: User-Name is not the same as MS-CHAP name<https://lists.freeradius.org/pipermail/freeradius-users/2011-June/msg00070.…> The last mention I can see of this was a few months ago, has anything changed since ? I was wondering if I can work around the issue by using realms to strip the username and then force the domain into the ntlm_auth line in the mschap module. I got some way with this approach but it still seems to wants to create the hash using the DOMAIN/USER which I'm guessing is wrong. Anyway, if there is a fix or workaround I'd be grateful if you could you let me know. Thanks, Bruce

1 0