January 2013 - Freeradius-Users - lists.freeradius.org

Freeradius2-2.1.12-4 crashes everyday
by Faisal M.A 08 Jan '13

08 Jan '13

Hi, My radius server is crashing almost everyday and I'm not sure what is the issue. Here is what i see, /etc/init.d/radiusd status radiusd dead but pid file exists I don't see any obvious message in my Syslog either. I'm using the free-radius on Centos 5.8 (2.6.18-308.16.1.el5PAE) freeradius2-ldap-2.1.12-4.el5_8 freeradius2-2.1.12-4.el5_8 Any idea ? Is there any bug ? Regards, Duke

4 5

default Fall-Through = Yes for groups
by Strong, Mark 08 Jan '13

08 Jan '13

Guys, Is there an option to set Fall-Through = Yes for groups as default, just wanted to avoid having Fall-Through = Yes in every group I have in radgroupreply. So if a user is a member of three groups I didn't want to have to put the Fall-Through attib in at least the first two groups, so he inherits the attibs from all three groups, thought there might be a setting in a config file for Fall-Through defaulting to Yes for groups, but couldn't see one. Regards Mark Strong

2 1

dictionary_kineto
by Yashaswini Sathyanarayana 08 Jan '13

08 Jan '13

How to add kineto specific attributes to free radius ?? Thanks & Regards, Yashaswini | Prod Engg | Tech Mahindra Ltd. 9 / 7 Hosur Road, Bangalore - 560029, India. (Office: +91 80 40243000, Extn: 3478 Mobile: +91 9611591177 www.techmahindra.com <http://www.techmahindra.com/> ============================================================================================================================ Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review the policy at <a href="http://www.techmahindra.com/Disclaimer.html">http://www.techmahindra.com/Disclaimer.html</a> externally and <a href="http://tim.techmahindra.com/tim/disclaimer.html">http://tim.techmahindra.com/tim/disclaimer.html</a> internally within Tech Mahindra. ============================================================================================================================

4 6

Fwd: rlm_sqlcounter always return 0
by Mike Russell 07 Jan '13

07 Jan '13

Dear Alan D. & List Users, I am reposting this message only because it bounced last due to size error. I tried to reduce the size but less information to see. Apologies if it was sent but i received bounce and no response from any member. ---------------: Orignal Message : ----------- I tried to search the mail archives for the similar topic but did not find matched results. Then read wiki again to crosscheck that if i have done it well before posting on the mailing list. I am sorry if similar post has been answered before. I have problem with "rlm_sqlcounter" module. That is "noresetcounter" it always return "0". But if i manually run the query to gerp the users accounting data from MySQL DB, i get accounting results. it seems that everything is in place but unable to know why sql counter still returns zero. whereas dailycounter works fine without any problem. My rlm_sqlnoresetcounter module: sqlcounter noresetcounter { driver = rlm_sqlcounter counter-name = Max-All-Session-Time check-name = Max-All-Session sqlmod-inst = sql key = User-Name reset = never query = "SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='${key}'" } To Prove the point i would also need to send radtest results for comparison: rad_recv: Access-Request packet from host 127.0.0.1 port 47871, id=159, length=84 User-Name = "KV60Rp2vtrEe5B" User-Password = "yuxNtwKbSH" NAS-IP-Address = 31.241.205.211 NAS-Port = 1812 Message-Authenticator = 0x2e53acc3936310719d3dc335a640afd4 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "KV60Rp2vtrEe5B", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [sql] expand: %{User-Name} -> KV60Rp2vtrEe5B [sql] sql_set_user escaped user --> 'KV60Rp2vtrEe5B' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'KV60Rp2vtrEe5B' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'KV60Rp2vtrEe5B' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'KV60Rp2vtrEe5B' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'One_Hour_Access' ORDER BY id [sql] User found in group One_Hour_Access [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'One_Hour_Access' ORDER BY id rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[pap] returns updated rlm_counter: Entering module authorize code rlm_counter: Could not find Check item value pair ++[daily] returns noop rlm_sqlcounter: Entering module authorize code sqlcounter_expand: 'SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='User-Name'' [noresetcounter] expand: SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='User-Name' -> SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='User-Name' *WARNING: Please replace '%S' with '${sqlmod-inst}'* sqlcounter_expand: '%{sql:SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='User-Name'}' [noresetcounter] sql_xlat [noresetcounter] expand: %{User-Name} -> KV60Rp2vtrEe5B [noresetcounter] sql_set_user escaped user --> 'KV60Rp2vtrEe5B' [noresetcounter] expand: SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='User-Name' -> SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='User-Name' rlm_sql (sql): Reserving sql socket id: 2 [noresetcounter] sql_xlat finished rlm_sql (sql): Released sql socket id: 2 [noresetcounter] expand: %{sql:SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='User-Name'} -> 0 rlm_sqlcounter: Check item is greater than query result rlm_sqlcounter: Authorized user KV60Rp2vtrEe5B, check_item=3600, counter=0 <------- This Value rlm_sqlcounter: Sent Reply-Item for user KV60Rp2vtrEe5B, Type=Session-Timeout, value=3600 ++[noresetcounter] returns ok [expiration] Checking Expiration time: '10 Jan 2013' ++[expiration] returns ok ++[logintime] returns noop Found Auth-Type = PAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! # Executing group from file /etc/raddb/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "yuxNtwKbSH" [pap] Using clear text password "yuxNtwKbSH" [pap] User authenticated successfully ++[pap] returns ok # Executing section session from file /etc/raddb/sites-enabled/default +- entering group session {...} [radutmp] expand: /var/log/radius/radutmp -> /var/log/radius/radutmp [radutmp] expand: %{User-Name} -> KV60Rp2vtrEe5B ++[radutmp] returns ok # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} [sql] expand: %{User-Name} -> KV60Rp2vtrEe5B [sql] sql_set_user escaped user --> 'KV60Rp2vtrEe5B' [sql] expand: %{User-Password} -> yuxNtwKbSH [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'KV60Rp2vtrEe5B', 'yuxNtwKbSH', 'Access-Accept', '2013-01-07 08:41:59') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'KV60Rp2vtrEe5B', 'yuxNtwKbSH', 'Access-Accept', '2013-01-07 08:41:59') rlm_sql (sql): Reserving sql socket id: 1 rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok ++[exec] returns noop Sending Access-Accept of id 159 to 127.0.0.1 port 47871 Session-Timeout := 3600 Idle-Timeout := 60 Acct-Interim-Interval := 120 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 159 with timestamp +311 Ready to process requests. Now lets grep the accounting value from database for the same user (returned "0" earlier) This user has "Max-All-Session" attribute applied and exist in "radgroupreply" table. mysql> SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='KV60Rp2vtrEe5B'; +--------------------------------+ | IFNULL(SUM(AcctSessionTime),0) | +--------------------------------+ | 380802 | +--------------------------------+ 1 row in set (0.00 sec) Why rlm_counter returns the zero value. Thanks / Russell M.

2 1

Re: how to read db files?
by Alan Buxey 07 Jan '13

07 Jan '13

Hi, Seems that the first thing you need to fix is your routing and access ACLs to Google ;) how to read Berkeley DB files Is pretty much a Google-whack. Might want to check out the db-utils package eg http://amath.colorado.edu/computing/spamtrack/bdb/ alan

2 1

Re: Failure with "TLS authentication" and "Freeradius on Fefora-17"
by Alan Buxey 07 Jan '13

07 Jan '13

Ummm, if you are using those scripts then you have local certs which are different on each server...and thus the client wouldnt match. If you require both servers to be used by the same client then you need to use the same CA on both server installs. Likewise, only one server/CA should be making your client cert. alan -- This smartphone uses free WiFi around the world with eduroam, now that's what I call smart.

1 0

rlm_sql_null not building
by Phil Mayers 07 Jan '13

07 Jan '13

I don't have the time to try and decipher the build system shenanigans, so I don't know why; this is from a tarball (NOT a git checkout) of "master" as of a few minutes ago. Maybe the empty "TARGET="?

1 2

rlm_ippool does not create DB and IDX files
by John Dennis 06 Jan '13

06 Jan '13

There was a thread back on April 18th with the subject "rlm_ippool does not create DB and IDX files" There were several incorrect statements and assumptions in that thread culminating in "it's a SELinux problem". Nope, it's not a SELinux problem. The fundamental problem is db_dir is set in /etc/raddb/radiusd.conf to /etc/raddb. This is incorrect, in fact the comment above the initialization of db_dir # Should likely be ${localstatedir}/lib/radiusd is exactly correct, it should be /var/lib/radiusd, why? 1) Files under /etc are supposed to be configuration files only 2) The directory /etc/raddb is writable only by root, the radiusd daemon is drops root privileges and runs as radiusd:radiusd (by default). 3) Database files are supposed to be located under /var/lib/{application} In the aforementioned thread the user apparently changed the ownership of /etc/raddb and the user:group the daemon was running under creating disinformation. If SELinux denied creating the db files under /etc/raddb after hacking the ownership and permissions then SELinux in fact operated correctly, you're not supposed to create/write database files under /etc, that violates the rules for what belongs under /etc. Instead /etc/raddb should have this line: db_dir = ${localstatedir}/lib/radiusd This has been reported as a configuration bug for Red Hat in: https://bugzilla.redhat.com/show_bug.cgi?id=891297 The above bug report also contains some additional information. -- John Dennis <jdennis(a)redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/

2 1

Failure with "TLS authentication" and "Freeradius on Fefora-17"
by Ajay Garg 06 Jan '13

06 Jan '13

Hi all. I have been facing a very particular issue, when trying to connect to a WPA/WPA-2 Enterprise connection via "TLS authentication" (note that "TTLS" and "PEAP" authentication work perfect). Settings :: a) As per http://cgit.freedesktop.org/NetworkManager/NetworkManager/tree/examples/pyt…, the code is written on a Fedora-18 base, using NM0.9 (this code is wriiten on the "client" computers, that wish to connect to the "TLS authenticated" WPA/WPA2-Enterprise network). b) Freeradius is being used as the user-authentication server. c) Now, when freeradius is being used on a Fedora-14 base, the "TLS" authentication works fine. I do the following, to generate the certificates required for TLS :: su - cd /etc/raddb/certs make clean make client.pem I then fill in the following fields (on the client-side):: 'client-cert': path_to_value("client.p12/generated/on/freeradius/on/Fedora14"), 'ca-cert': path_to_value("ca.pem/generated/on/freeradius/on/Fedora14"), 'private-key': path_to_value("client.p12/generated/on/freeradius/on/Fedora14"), The client gets connected flawlessly to the wifi-network :) d) However, when freeradius is used on a Fedora-18 base, the "TLS" authentication does not work fine. I follow the same procedure to generate the certificates :: su - cd /etc/raddb/certs make clean make client.pem and then fill up the values as :: 'client-cert': path_to_value("client.p12/generated/on/freeradius/on/Fedora17"), 'ca-cert': path_to_value("ca.pem/generated/on/freeradius/on/Fedora17"), 'private-key': path_to_value("client.p12/generated/on/freeradius/on/Fedora17"), However, now the wifi-network is not connected; there are "Access-Reject" messages in freeradius-logs. Has there been a change in the way certificates are to generated/deployed when using Free-radius on Fedora-17? Or there needs to be a change in the NM-client-side-code? I will be grateful for a reply. Regards, Ajay

2 2

performance freeradius 2.1 and 2.2
by Sang Lee 05 Jan '13

05 Jan '13

hi there, does anybody have some data for the performance of freeradius 2.1 and 2.2? what is the maximum number of auth request per second that radius able to handle? many thanks in advance. thanks, sang

2 1