February 2012 - Freeradius-Users - lists.freeradius.org

Setting up FreeRADIUS
by ryuukuu 22 Feb '12

22 Feb '12

I seem to be having a hardtime setting up FreeRADIUS to work with my Astaro firewall. First, in radiusd.conf I have left most of the configurations the same only made a few small ones such as the port for: listen { type = auth ipaddr = * port = 1812 (instead of the default 0) } In clients.conf, I have added the following: client ASG { ipaddr = 192.168.***.*** secret = my secret } In /etc/raddb/users I added user Cleartext-Password password. In Astaro I created a network definition with "host," as the type, ANY interface, and the IP for my box running FreeRADIUS. I also created a packet filter rule as follows: Group: WiFi Position: 59 Source: srv_freeradius Service: RADIUS Destination: firewall In the wireless security setting of Astaro under Advance/Enterprise Authentication I added the following information: RADIUS: srv_freeradius (network defition I created) RADIUS Port: RADIUS (This was already in place there) RADIUS Secret: my secret Repeat Secret: repeated secret Now whenever I run radtest user password localhost 0 secret I get the Access-Accept packet but if I modify the command and run radtest user password ASG_IP 1812 secret I get "radclient: no response from server for ID 168 socket 3" I also tried running radtest user password FreeRADIUS_Server_IP 1812 secret and the output in /usr/sbin/radiusd -X is as follows: " Ignoring request to authentication address * port 1812 from unknown client 192.168.***.*** port 48063 Ready to process requests." -- View this message in context: http://freeradius.1045715.n5.nabble.com/Setting-up-FreeRADIUS-tp5506078p550… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

FreeRadius to authenticate DHCP Requests with Option82
by sachin.sharma＠wipro.com 22 Feb '12

22 Feb '12

Hello all, I am implementing Free Radius to authenticate DHCP Requests with Option82. I have configured DHCP Relay Agent, DHCP Snooping in CISCO Switch and DHCP Server. Now i have to configure RADIUS for option82. Please help me to configure RADIUS for DHCP option82. Also i am not clear who will authenticate to RADIUS, Switch,DHCP Relay Agent or DHCP Server. After reading docs i guess it's DHCP Server .... Br. Sachin Sharma Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

5 10

Possible bug in rlm_sqlcounter examples
by Tim White 22 Feb '12

22 Feb '12

Hi All. I am using the following SQL in sqlcounter for a MySQL database in the Grase Hotspot project, as part of daily/hourly/monthly counters. query = "SELECT SUM(acctsessiontime - \ GREATEST((%b - UNIX_TIMESTAMP(acctstarttime)), 0)) \ FROM radacct WHERE username = '%{%k}' AND \ UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%b'" This is taken directly out of the examples that come with Freeradius, and is also in the Wiki. http://wiki.freeradius.org/Rlm_sqlcounter#Example+Setup Recently I was having problems where the first login for a day, wasn't being limited to it's daily limit. However, subsequent logins for they day were. So for example, if they had a 4 hour limit, and the first login went over 4 hours, it could keep going as Session-Limit was being returned by freeradius. However, all subsequent logins would return a valid Session-Limit (timeout?) or an access denied if they had gone over the daily limit. Some poking around showed that if there was no logins for that day, the above SQL will return NULL, which Freeradius complains about, something along the lines of there not being an integer in the results (I can't get the exact error message right now), and so the sqlcounter just passes through as noop. To solve the problem, I needed to use an IFNULL (or COALESCE) to return a 0 instead of NULL and then Freeradius sqlcounter returns the correct attributes. query = "SELECT COALESCE( SUM(acctsessiontime - \ GREATEST((%b - UNIX_TIMESTAMP(acctstarttime)), 0)) ) \ FROM radacct WHERE username = '%{%k}' AND \ UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%b'" This happens on the arm architecture, and so may be architecture dependent. A quick test on x86 MySQL shows it also returns NULL, however I've not had the chance to test how Freeradius interprets the NULL, as 0 or NULL. I will get out an x86 test machine shortly and test what Freeradius is returning. $ apt-cache policy freeradius freeradius: Installed: 2.1.10+dfsg-2 Debian 6.0.3 Linux Kernel 2.6.32 armv5tel Has anyone else run into this problem? Tim

2 2

confused by logging targets for rlm_perl
by Olivier Bilodeau 22 Feb '12

22 Feb '12

Hi there! It's been a while.. François turned out to be our official freeradius-users correspondent lately ;) So, I'm changing some things in our rlm_perl module and tried to make a better use of the logging facilities provided by the freeradius core. http://wiki.freeradius.org/Rlm_perl#Logging refers to: 0 - Debug 1 - Auth 2 - Proxy 3 - Info 4 - Error However in practice my tests today revealed behavior that I would prefer be clarified by one of the gurus here. With file logging, auth = yes and sending messages with &radiusd::radlog() I found that: Debug, Info and Error goes to the radius.log file while Auth does not. I haven't tried Proxy or Acct (which is available according to src/main/log.c). I expected Debug not to go out in radius.log and Auth to do since I specified Auth to yes in radiusd.conf. With radius -X, as expected, I got everything. Am I missing something here? Is this a bug or a feature(tm)? Running freeradius 2.1.12. Thanks, -- Olivier Bilodeau obilodeau(a)inverse.ca :: +1.514.447.4918 *115 :: www.inverse.ca Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (www.packetfence.org)

2 1

2.1.12 segfault with ldap module
by Brian De Wolf 21 Feb '12

21 Feb '12

While setting up freeradius recently, we noticed that it would segfault on a restart after being used. The segfault line would be something like: kernel: radiusd[2608]: segfault at 7feb7471f480 ip 00007feb7471f480 sp 00007fff451ea168 error 14 in libfreeradius-eap-2.1.12.so[7feb74d2b000+9000] At first I thought this would be something in the eap module, but after building a debug build and running it in gdb I got this backtrace: Program received signal SIGSEGV, Segmentation fault. 0x00007ffff3e0f480 in ?? () (gdb) bt #0 0x00007ffff3e0f480 in ?? () #1 0x00007ffff71d9dea in ?? () from /usr/lib64/libcrypto.so.1.0.0 #2 0x00007ffff755a12d in SSL_free () from /usr/lib64/libssl.so.1.0.0 #3 0x00007ffff548b1da in ?? () from /usr/lib64/libldap_r-2.4.so.2 #4 0x00007ffff524df59 in ber_sockbuf_remove_io () from /usr/lib64/liblber-2.4.so.2 #5 0x00007ffff524dfed in ber_int_sb_destroy () from /usr/lib64/liblber-2.4.so.2 #6 0x00007ffff524e06c in ber_sockbuf_free () from /usr/lib64/liblber-2.4.so.2 #7 0x00007ffff546fb2c in ldap_ld_free () from /usr/lib64/libldap_r-2.4.so.2 #8 0x00007ffff56a50c0 in ldap_detach (instance=<value optimized out>) at rlm_ldap.c:2588 #9 0x00000000004186ce in module_instance_free (data=<value optimized out>) at modules.c:380 #10 0x00007ffff7bcee4d in FreeWalker (tree=0x796a50, X=0x799670) at rbtree.c:63 #11 0x00007ffff7bcee8e in rbtree_free (tree=0x9b14c0) at rbtree.c:74 #12 0x0000000000419450 in detach_modules () at modules.c:428 #13 0x000000000041d13c in main (argc=<value optimized out>, argv=<value optimized out>) at radiusd.c:456 After seeing that it looks like it's actually the ldap module causing problems, I commented out all of my bits that use the ldap module and it doesn't segfault on shutdown. I also tried it with ldap but without TLS enabled and it shut down clean still. Has anyone seen this before? Any solutions? For the time being, I guess I'll run the ldap module without TLS enabled. Segfaults, even benign ones, seem to get everyone antsy...

2 2

Please update your configuration so that the "known good" clear text password is in Cleartext-Password, and not in User-Password
by Yannick Barbeaux 21 Feb '12

21 Feb '12

Hello, I know this question has been asked many times before yet I could not find a solution to my problem: On debian squeeze, I installed freeradius 2.1.10 and use mysql (5.1.49) for the authentication (I uncommented the line "sql" in the 'authorize' and 'accounting' sections of /etc/freeradius/sites-available/default ) When I test with the following command: root@my-machine:~# radtest sqltest testpwd localhost 1812 testing123 Sending Access-Request of id 116 to 127.0.0.1 port 1812 User-Name = "sqltest" User-Password = "testpwd" NAS-IP-Address = 10.50.1.3 NAS-Port = 1812 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=116, length=20 it receives the authorization correctly. It works fine... Yet, on the debugging messages, I see the following (famous) message: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! I have read in the messages archive that I should "replace in your configuration (either user file or database) all occurrences of "User-Password" with "Cleartext-Password"." Yet in my DB, I have: mysql> select * from radcheck; +----+----------+-----------+----+---------+ | id | username | attribute | op | value | +----+----------+-----------+----+---------+ | 1 | sqltest | Password | == | testpwd | +----+----------+-----------+----+---------+ If I change the attribute to "Cleartext-Password" instead of "Password", the connection is rejected (ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user) I did grep "Cleartext" in /etc/freeradius/* but found nothing. Should I really worry about that warning and if yes, how can I get rid of that message? DEBUG INFO: ----------- Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 35731, id=116, length=59 User-Name = "sqltest" User-Password = "testpwd" NAS-IP-Address = 10.50.1.3 NAS-Port = 1812 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "sqltest", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [sql] expand: %{User-Name} -> sqltest [sql] sql_set_user escaped user --> 'sqltest' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'sqltest' ORDER BY id WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'sqltest' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'sqltest' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! # Executing group from file /etc/freeradius/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "testpwd" [pap] Using clear text password "testpwd" [pap] User authenticated successfully ++[pap] returns ok # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 116 to 127.0.0.1 port 35731 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 116 with timestamp +2 Ready to process requests --------------- I did read 'man rlm_pap' as suggested but could not find the solution. Here is an excerpt of my /etc/freeradius/sites-available/default : authorize { preprocess chap mschap digest suffix eap { ok = return } sql expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } digest unix eap } Any help would be greatly appreciated. Yannick

2 1

Freeradius stopped to work
by dorje2007＠seznam.cz 20 Feb '12

20 Feb '12

Hi after more then year my freeradius 2.1.9 stopped to work in log I have a lot of the following info: ....Feb 20 13:11:55 radius radiusd[12006]: WARNING: Child is hung for request 35 in component accounting module radutmp. Feb 20 13:11:56 radius radiusd[12006]: WARNING: Child is hung for request 34 in component accounting module radutmp. Feb 20 13:11:56 radius radiusd[12006]: WARNING: Child is hung for request 51 in component accounting module radutmp. .... Feb 20 13:10:45 radius radiusd[12006]: WARNING: Unresponsive child for request 134, in module radutmp component accounting Feb 20 13:10:47 radius radiusd[12006]: WARNING: Unresponsive child for request 132, in module radutmp component accounting Feb 20 13:10:48 radius radiusd[12006]: WARNING: Unresponsive child for request 136, in module radutmp component accounting and so on When i restart the radius, it start to work, then after a few minutes goes down Any idieas ? thanks pet

5 11

Problem with freeradius
by slaserx 20 Feb '12

20 Feb '12

Hi i run freeradius version radiusd: FreeRADIUS Version 2.1.12, for host i386-portbld-freebsd9.0, built on Jan 19 2012 at 22:04:35 on my FreeBSD but i have problem with radclient and radzap i don`t can to disconnect the users... give me this error radclient: no response from server for ID 144 socket 3 i use radzap -u user 127.0.0.1 secret and have this answer for server [root@skynet /]# radzap -u office 127.0.0.1 pass radclient: no response from server for ID 122 socket 3 [root@skynet /]# Please help me -- View this message in context: http://freeradius.1045715.n5.nabble.com/Problem-with-freeradius-tp5499520p5… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

Freeradius and eduroam
by Mahmudul Hasan 20 Feb '12

20 Feb '12

Hi, I am currently trying to setup freeradius to work with eduroam. Does anyone have a sample configuration files for 2.1.10 version of freeradius ? Even if there is a guideline (specially regarding the proxy.conf file and the tunnels), it will be a great help. I am currently considering PEAP-MSCHAPv2 for encrypting my radius packets. Thank you, Mahmudul Hasan University of Lethbridge, Alberta,Canada.

5 5

rlm_perl and returning > 1 attribute with same name
by Mike 20 Feb '12

20 Feb '12

Hello, I am using rlm_perl and I have an application where I would like to return possibly more than 1 Filter-Id in my response. In perl, the relevent code would be this: $RAD_REPLY{'Filter-Id'} = "some_filter" Unfortunately, this also will only create 1 avpair by the name 'Filter-Id'. How would I go about returning more than 1 or am I stuck because of perl? Mike-

3 2