September 2011 - Freeradius-Users - lists.freeradius.org

Duplicate Start packets in RadAcct table
by zwolfinger 28 Sep '11

28 Sep '11

I am seeing duplicate START packets in the RadAcct table. When a STOP packet is received, it applies to only one of the duplicated START packets, leaving a "phantom" START packet. Debug (/usr/sbin/freeside -Xx) appears to show the START packet only being received and inserted in the table once. Any thoughts on how this can be happening / how to fix it? Thanks! -- View this message in context: http://freeradius.1045715.n5.nabble.com/Duplicate-Start-packets-in-RadAcct-… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

Postgresql undefined symbol PQinitSSL
by Thor Spruyt 28 Sep '11

28 Sep '11

Hi, I have the same problem with both 2.1.11 and 2.1.12-pre ... I'm on CentOS 4.6 with following RPMs: $ rpm -qa | grep devel glibc-devel-2.3.4-2.39 krb5-devel-1.3.4-60.el4_7.2 mysql-devel-5.0.54-1.el4.centos openssl-devel-0.9.7a-43.17.el4_8.5 kernel-smp-devel-2.6.9-67.0.4.EL e2fsprogs-devel-1.35-12.17.el4 zlib-devel-1.2.1.2-1.2 openldap-devel-2.2.13-12.el4 kernel-devel-2.6.9-67.0.4.EL cyrus-sasl-devel-2.1.19-14 postgresql-devel-7.4.19-1.el4_6.1 $ rpm -qa | grep postgresql postgresql-7.4.19-1.el4_6.1 postgresql-libs-7.4.19-1.el4_6.1 postgresql-server-7.4.19-1.el4_6.1 postgresql-devel-7.4.19-1.el4_6.1 $ rpm -qa | grep openssl openssl-devel-0.9.7a-43.17.el4_8.5 xmlsec1-openssl-1.2.6-3 openssl096b-0.9.6b-22.46 openssl-0.9.7a-43.17.el4_8.5 I use the following configure options: ./configure --prefix=/opt/freeradius-server-2.1.12 --with-mysql --with-postgresql --with-openldap --with-openssl --without-snmp --without-krb5 --without-dhcp Everything seems to build fine, here's the postgresql module build output: Making all in rlm_sql_postgresql. gmake[10]: Entering directory `/home/thor/freeradius-server-2.1.12/src/modules/rlm_sql/drivers/rlm_sql_postgresql' /home/thor/freeradius-server-2.1.12/libtool --mode=compile gcc -g -O2 -Wall -D_GNU_SOURCE -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DNDEBUG -I../.. -I/home/thor/freeradius-server-2.1.12/src/ -I/usr/include/postgresql -I/home/thor/freeradius-server-2.1.12/libltdl -c sql_postgresql.c mkdir .libs gcc -g -O2 -Wall -D_GNU_SOURCE -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DNDEBUG -I../.. -I/home/thor/freeradius-server-2.1.12/src/ -I/usr/include/postgresql -I/home/thor/freeradius-server-2.1.12/libltdl -c sql_postgresql.c -fPIC -DPIC -o .libs/sql_postgresql.o sql_postgresql.c: In function `sql_init_socket': sql_postgresql.c:153: warning: implicit declaration of function `PQinitSSL' gcc -g -O2 -Wall -D_GNU_SOURCE -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DNDEBUG -I../.. -I/home/thor/freeradius-server-2.1.12/src/ -I/usr/include/postgresql -I/home/thor/freeradius-server-2.1.12/libltdl -c sql_postgresql.c -o sql_postgresql.o >/dev/null 2>&1 /home/thor/freeradius-server-2.1.12/libtool --mode=link gcc -release 2.1.12 \ -module -export-dynamic -o rlm_sql_postgresql.la \ -rpath /opt/freeradius-server-2.1.12/lib sql_postgresql.lo -L/usr/lib -lpq gcc -shared .libs/sql_postgresql.o -L/usr/lib -lpq -Wl,-soname -Wl,rlm_sql_postgresql-2.1.12.so -o .libs/rlm_sql_postgresql-2.1.12.so (cd .libs && rm -f rlm_sql_postgresql.so && ln -s rlm_sql_postgresql-2.1.12.so rlm_sql_postgresql.so) ar cru .libs/rlm_sql_postgresql.a sql_postgresql.o ranlib .libs/rlm_sql_postgresql.a creating rlm_sql_postgresql.la (cd .libs && rm -f rlm_sql_postgresql.la && ln -s ../rlm_sql_postgresql.la rlm_sql_postgresql.la) gmake[10]: Leaving directory `/home/thor/freeradius-server-2.1.12/src/modules/rlm_sql/drivers/rlm_sql_postgresql' But then when starting the server with -X with my configuration, I get the following and it stops: rlm_sql Creating new attribute sql_auth1-SQL-Group rlm_sql (sql_auth1): Driver rlm_sql_postgresql (module rlm_sql_postgresql) loaded and linked rlm_sql (sql_auth1): Attempting to connect to radius@195.130.158.155:/radius rlm_sql (sql_auth1): starting 0 rlm_sql (sql_auth1): Attempting to connect rlm_sql_postgresql #0 /opt/radproxyin/freeradius/sbin/radiusd: symbol lookup error: /opt/freeradius-server-2.1.12/lib/rlm_sql_postgresql-2.1.12.so: undefined symbol: PQinitSSL Any ideas on what could be the problem here or any solution or tips on where to look further? P.S.: I'm not looking to get SSL working for my database connections, I just want to get the server running with postgresql and eap support built in. Regards, Thor

2 2

Last call for 2.1.12
by Alan DeKok 28 Sep '11

28 Sep '11

I've put new images of 2.1.12 on the web site: http://git.freeradius.org/pre/ If there are no objections, I will release 2.1.12 on Friday, using those exact files. Please test && report any show-stoppers. Alan DeKok.

1 0

Confused what to do next~How to understand FreeRadius
by snan4love 28 Sep '11

28 Sep '11

Hello Everyone: Thank you very much for opening this topic. I have worked on FreeRadius for almost 2 monthes,my purpose is to set up a Radius server which could be used for authentication , authority and accounting for my WLAN. Right now, I "guess" i have finished the "Authentication Step". I installed the Radius server + MySQL on my FC 14 host,there is a client AP connect to this radius server, the users hold Windows XP laptop could get authentication from radius server via PEAP or EAP-TLS. Here is a first little problem.Right now i could add and delete user in the radcheck table of MySQL,but all the passwords were stored in cleartext?is this the only way to store this password? is it safe enough?is it could be store in the format of ****** like what we set in the wpa-psk mode? Most Seriously, I am confused how to implement the "Authority Step" and "Accounting Step". For the "Authority Step",in my thought, I should create several different GROUPs, each GROUP has different authority,and then divide the users into different GROUPs and get different authority. Is that correct? For the "Accounting Step",i used DaloRadius,but found out there are few help for this web base management system online, and the MANUAL will cost $250.And also the additional mySQL tables makes me more confused. I want to know if there is a example that set up the authority and accounting features of FreeRadius?or just give me a little hints about where to start it step by step.I know there is a really big question. Any hints will be really help,any useful docments and links will be really appreciate. For example, there are 9 tables in the defalut mysql scheme, like radcheck,radacct,nas,radgroup,radgroupreply etc, is there a document to describe these features? I read all the .conf files couple of times ,but still confused about this stuff. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Confused-what-to-do-next-How-to-und… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 7

FR, SQL backend and Foreign keys
by Fabien COMBERNOUS 28 Sep '11

28 Sep '11

Hi, In the samples schema.sql proposed for SQL backend, no foreign keys are used. Any reason ? With ON DELETE CASCADE or ON UPDATE CASCADE constraint it should be easier to manage updates or deletetion of records ? Am i missing something ? -- *Fabien COMBERNOUS* /unix system engineer/ www.kezia.com <http://www.kezia.com/> *Tel: +33(0)9 5279 5202* Kezia

4 7

Enforcing Login-Time on NAS
by Shiv 28 Sep '11

28 Sep '11

I know that Login-Time can be used with Users and Groups but is there a way to use this with NAS'? For example, If I want NAS-A to allow logins only from 1700-1800 and NAS-B to allow logins only from 0900-1300. How would I be able to ensure this? I have tried this with Huntgroups, but only able to prevent/allow logins unconditionally. How do I attach the Login-Time attribute to NAS and not users or groups? -- Regards, Shivkumar

4 7

[mschap] FAILED: MS-CHAP2-Response is incorrect
by sekchel lee 28 Sep '11

28 Sep '11

mysql> select * from radcheck; +----+------------+---------------+----+------------------------------------+ | id | username | attribute | op | value | +----+------------+---------------+----+------------------------------------+ | 1 | testuser | User-Password | := | $1$vQGXHdnO$7DjKbeUeAadrsfGg8thE2. | FreeRADIUS Version 2.1.7, for host i686-redhat-linux-gnu, built on Mar 31 2010 at 00:25:31 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/sql.conf including configuration file /etc/raddb/sql/mysql/dialup.conf including configuration file /etc/raddb/sql/mysql/counter.conf including configuration file /etc/raddb/sqlippool.conf including configuration file /etc/raddb/sql/mysql/ippool.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/control-socket including configuration file /etc/raddb/sites-enabled/default group = radiusd user = radiusd including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client xxx.xx.xxx.124 { ipaddr = xx0.xx.xxx.124 require_message_authenticator = no secret = "test1234" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = no require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Ready to process requests. rad_recv: Access-Request packet from host xxx.xx.xxx.124 port 45736, id=85, length=153 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "testuser" MS-CHAP-Challenge = 0x3ee4b2159d1bb98a2346bc0486f40c76 MS-CHAP2-Response = 0x810075b62261a0af713e9ea1efa6847ab7b8000000000000000020fd3c4aa07aa4adcc5fc0b9c6b8a8245ec3a2d2399a5df8 Calling-Station-Id = "xx.xx.229.203" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok [suffix] No '@' in User-Name = "testuser", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 172 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for testuser with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> testuser attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 85 to xxx.xx.xxx.124 port 45736 Waking up in 4.9 seconds. Cleaning up request 0 ID 85 with timestamp +7 Ready to process requests.

2 1

couldn't link driver rlm_sql_mysql
by gary 28 Sep '11

28 Sep '11

Hi All I am setting up freeradius 2.1.11+mysql 5.5.16 on Fedora 13. Executing command "radiusd -X" it says could not link driver rlm_sql_mysql(read as below). It not worked even I install "freeradius-mysql" library but I can find the driver "rlm_sql_mysql.so" in "/usr/lib/freeradius" folder. Anyone can help me? ################################################################### #radiusd -X Could not link driver rlm_sql_mysql: rlm_sql_mysql.so: cannot open shared object file: No such file or directory Make sure it (and all its dependent libraries!) are in the search path of your system's ld. /usr/local/etc/raddb/sql.conf[22]: Instantiation failed for module "sql" /usr/local/etc/raddb/sites-enabled/default[166]: Failed to load module "sql". /usr/local/etc/raddb/sites-enabled/default[69]: Errors parsing authorize section. ################################################################## Best Regards Gary

3 3

Re: MySQL and FreeRADIUS environment.
by Alan Buxey 27 Sep '11

27 Sep '11

Master/slave, or replication and remote accounting, if you want one true source let radius deal with the sql rather than trying anything with sql. Final advice would be to use postgresql rather than mysql, our performance increase was a magnitude better when we ditched mysql alan

2 1

Help desk support of authn/authz failures? Logging detailed messages to SQL?
by Jason Antman 27 Sep '11

27 Sep '11

We've rolled out FreeRADIUS as the authentication and authorization server for our University-wide WLAN with 30,000+ users. Our help desk (general IT, not wireless-specific) support staff is made up of student workers, with full-time second-level support and us sysadmins/wireless engineers for third-level support. As we've rolled out WPA2 and the supplicants give no useful information about authentication failures to end-users, our help desk is being inundated with "help, I can't login" calls. We do auth logging to MySQL. Help desk staff are not given access to our authentication servers, so our current solution is to use lots of unlang config kludge in authorize{} to defer any notfound or reject module responses (configurable failover), then use if statements to check the actual return of the module. If it's a "bad" user (notfound, reject, etc.) we set a locally-defined string attribute (control:Reject-Reason) and then reject the user, and Post-Auth Type Reject logs to SQL including that string reason. Which is then accessible in a read-only web tool for the help desk. 1) How do other people - specifically organizations with a help desk large enough that they're distinctly separate from anyone with enough privs to tail a log file - handle user support of authentication failures? 2) This is proving problematic with users who have EAP misconfigurations, empty LDAP passwords, etc. that only manifest as a module failure and only show up in the log file. I've been considering patching the relevant modules to add/update an attribute on failure, since currently AFAIK this information is only available in the log file, and not anywhere that I can include in the SQL post-auth log. Has anyone else done anything similar? Or is more detailed module failure information accessible through something that I haven't been able to find in the docs? Thanks for any advice/insights, Jason -- Jason Antman System Administrator Rutgers University OIT Central Systems & Services / NetOps Office: 732-445-6363 Cell: 732-983-7256 jantman(a)oit.rutgers.edu

3 4