November 2014 - Freeradius-Users - lists.freeradius.org

patch where?: WARNING: Child is hung for request XXXX in component <core> module (2.2.5)
by Jonathan 23 Nov '14

23 Nov '14

Where can i find the patch as the 2.x.x checkout doesnt contain it yet On Friday, November 21, 2014, Alan DeKok <aland(a)deployingradius.com> wrote: > Jonathan wrote: > > The problem we are having is that whenever a radius proxy server > > (outside of our control: eduroam national home server) doesn't respond > > in time, we get the following messages blocking freeradius: > > > > Fri Nov 21 17:02:07 2014 : Error: Internal sanity check failed for > > child state <= NEW MESSAGE since 2.2.6 > > That means the following has happened: > > - the server proxied a request to a home server > - eventually, the server gives up, and uses Post-Proxy-Type Fail > - while it's running that, the home server replies. > > > Fri Nov 21 17:02:07 2014 : Error: Reply from home server A.B.C.D port > > 1812 - ID: 84 arrived too late for request 11986. Try increasing > > 'retry_delay' or 'max_request_time' > > Fri Nov 21 17:02:18 2014 : Error: WARNING: Unresponsive thread 11986 > > for request 0, in component <core> module > > Fri Nov 21 17:02:19 2014 : Info: WARNING: Child is hung for request > > 11986 in component <core> module . > > That's wrong... it means that the request isn't being processed > through a module, BUT the server core thinks that a thread is still > processing it. > > Hmm... please try the v2.x.x branch: > > https://github.com/FreeRADIUS/freeradius-server/archive/v2.x.x.zip > > I've found one thing which makes me go "Huh?" > > Hopefully that should fix it. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

2 6

rlm_ippool: Deallocated entry for ip/port
by Akira Yata 22 Nov '14

22 Nov '14

Hi all! I have a problem with freeradius1.1 or NAS. " Deallocated entry for ip/port " messages were shown in some users. IP address that were shown as deallocated entry ip addresses were allocated as framed-ip-address for differenet user, but some were not allocated as framed-ip-address. I'm searching cause of this problem for few days. I'm sorry with my terrible English and silly query. if you need more information plese let me know. Any advice will help me,Thanks in advance. debug log is below Sending Accounting-Response of id 140 to 192.168.11.1 port 50016 rad_recv: Accounting-Request packet from host 192.168.11.1:50016, id=141, length=247 Acct-Status-Type = Stop User-Name = "aaa@.or.jp" Event-Timestamp = "Nov 22 2014 12:00:54 JST" Acct-Delay-Time = 3 NAS-Identifier = "cisco" Acct-Session-Id = "erx FastEthernet 1/6.3:0:0029047976" NAS-IP-Address = 192.168.11.1 Service-Type = Framed-User Calling-Station-Id = "#cisco#E16#0" Acct-Input-Gigawords = 0 Acct-Input-Octets = 0 Acct-Output-Gigawords = 0 Acct-Output-Octets = 0 ERX-Input-Gigapkts = 0 Acct-Input-Packets = 0 ERX-Output-Gigapkts = 0 Acct-Output-Packets = 0 NAS-Port-Type = Ethernet NAS-Port = 369098752 NAS-Port-Id = "FastEthernet 1/6.3:0" Acct-Session-Time = 0 Acct-Terminate-Cause = User-Error rlm_radutmp: Logout for NAS 192.168.11.1 port 369098752, but no Login record rlm_ippool: Searching for an entry for nas/port: 192.168.11.1/369098752 rlm_ippool: Deallocated entry for ip/port: 10.10.10.1/369098752 Sending Accounting-Response of id 142 to 192.168.11.1 port 50016 rad_recv: Accounting-Request packet from host 192.168.11.1:50016, id=143, length=242 Acct-Status-Type = Stop User-Name = "bbb@.or.jp" Event-Timestamp = "Nov 22 2014 12:00:54 JST" Acct-Delay-Time = 3 NAS-Identifier = "cisco" Acct-Session-Id = "erx FastEthernet 1/6.3:0:0029047977" NAS-IP-Address = 192.168.11.1 Service-Type = Framed-User Calling-Station-Id = "#cisco#E16#0" Acct-Input-Gigawords = 0 Acct-Input-Octets = 0 Acct-Output-Gigawords = 0 Acct-Output-Octets = 0 ERX-Input-Gigapkts = 0 Acct-Input-Packets = 0 ERX-Output-Gigapkts = 0 Acct-Output-Packets = 0 NAS-Port-Type = Ethernet NAS-Port = 369098752 NAS-Port-Id = "FastEthernet 1/6.3:0" Acct-Session-Time = 0 Acct-Terminate-Cause = User-Error rlm_radutmp: Logout for NAS 192.168.11.1 port 369098752, but no Login record rlm_ippool: Searching for an entry for nas/port: 192.168.11.1/369098752 rlm_ippool: Deallocated entry for ip/port: 10.10.10.1/369098752 Sending Accounting-Response of id 143 to 192.168.11.1 port 50016 rad_recv: Accounting-Request packet from host 192.168.11.1:50016, id=144, length=240 Acct-Status-Type = Stop User-Name = "ccc@.or.jp" Event-Timestamp = "Nov 22 2014 12:00:54 JST" Acct-Delay-Time = 3 NAS-Identifier = "cisco" Acct-Session-Id = "erx FastEthernet 1/5:0029047978" NAS-IP-Address = 192.168.11.1 Service-Type = Framed-User Calling-Station-Id = "#cisco#E15#0" Acct-Input-Gigawords = 0 Acct-Input-Octets = 0 Acct-Output-Gigawords = 0 Acct-Output-Octets = 0 ERX-Input-Gigapkts = 0 Acct-Input-Packets = 0 ERX-Output-Gigapkts = 0 Acct-Output-Packets = 0 NAS-Port-Type = Ethernet NAS-Port = 352321536 NAS-Port-Id = "FastEthernet 1/5" Acct-Session-Time = 0 Acct-Terminate-Cause = User-Error rlm_radutmp: Logout for NAS 192.168.11.1 port 352321536, but no Login record rlm_ippool: Searching for an entry for nas/port: 192.168.11.1/352321536 rlm_ippool: Deallocated entry for ip/port: 10.10.10.2/352321536 Sending Accounting-Response of id 144 to 192.168.11.1 port 50016 rad_recv: Accounting-Request packet from host 192.168.11.1:50016, id=145, length=249 Acct-Status-Type = Stop User-Name = "ddd@.or.jp" Event-Timestamp = "Nov 22 2014 12:00:54 JST" Acct-Delay-Time = 3 NAS-Identifier = "cisco" Acct-Session-Id = "erx FastEthernet 1/6.2:102:0029047979" NAS-IP-Address = 192.168.11.1 Service-Type = Framed-User Calling-Station-Id = "#cisco#E16#102" Acct-Input-Gigawords = 0 Acct-Input-Octets = 0 Acct-Output-Gigawords = 0 Acct-Output-Octets = 0 ERX-Input-Gigapkts = 0 Acct-Input-Packets = 0 ERX-Output-Gigapkts = 0 Acct-Output-Packets = 0 NAS-Port-Type = Ethernet NAS-Port = 369098854 NAS-Port-Id = "FastEthernet 1/6.2:102" Acct-Session-Time = 0 Acct-Terminate-Cause = User-Error rlm_radutmp: Logout for NAS 192.168.11.1 port 369098854, but no Login record rlm_ippool: Searching for an entry for nas/port: 192.168.11.1/369098854 rlm_ippool: Deallocated entry for ip/port: 210.229.182.164/369098854

2 1

info: WARNING: Child is hung for request XXXX in component <core> module (2.2.5)
by Jonathan 22 Nov '14

22 Nov '14

Hi we regulary get these messages since we upgraded from 2.2.3 to 2.2.5 I have attached the GDB log as i'm no developper expert to find out what's going on... Hopefully someone can help us out with this <SOME INFO> We are running Debian 7.7 x64 Linux 3.2.0-4-amd64 (radius1) 10/22/2014 _x86_64_ (8 CPU) avg-cpu: %user %nice %system %iowait %steal %idle 0.24 0.00 0.11 0.10 0.00 99.56 Device: tps kB_read/s kB_wrtn/s kB_read kB_wrtn cciss/c0d0 163.25 9.31 1491.34 3263611 522909360 <RADIUS LOGS> Wed Oct 22 16:35:35 2014 : Error: Discarding duplicate request from client telenet-81.82.0.0/15 port 3072 - ID: 226 due to unfinished request 2664227 Wed Oct 22 16:35:37 2014 : Error: WARNING: Unresponsive thread 2664227 for request 0, in component <core> module Wed Oct 22 16:35:38 2014 : Info: WARNING: Child is hung for request 2664227 in component <core> module . Attached a debug with command, "echo 'thread apply all bt full' > /tmp/gdb_cmd; gdb --pid `cat /var/run/freeradius/freeradius.pid` -batch -x /tmp/gdb_cmd > gdb_bt; gzip gdb_bt" Hopefully this brings something useful, as previous debug to devel list didnt show the reason.

4 11

UserDN escape problem and Group membership checking in 3.0.3
by Winders, Timothy A 21 Nov '14

21 Nov '14

I have FreeRadius 3.0.3 installed on Ubuntu 14.0.4 (free radius 3.0.3-ppa1~trustry package) I have everything setup with Active Directory for user authentication. This is working correctly, but I am having a problem with Active Directory group membership checking. It appears the problem is with the way FreeRadius escapes the UserDN when doing the query. I have tried various ldap configuration options, none of which quite work. If I remove all the filter settings from the group checking and only use the membership_attribute = "memberOf", I get the following Invalid DN syntax error: rlm_ldap (ldap): Bind successful (11) User object found at DN "CN=Winders\, Tim (0552),OU=Students,OU=SPC,DC=southplainscollege,DC=edu" (11) Checking user object membership (memberOf) attributes (11) Waiting for bind result... (11) Bind successful (11) Performing unfiltered search in 'CN=Winders, Tim (0552),OU=Students,OU=SPC,DC=southplainscollege,DC=edu', scope 'base' (11) Waiting for search result... (11) ERROR: Failed performing search: Invalid DN syntax (11) ERROR: Server said: 0000208F: NameErr: DSID-031001F7, problem 2006 (BAD_NAME), data 8350, best match of: 'CN=Winders, Tim (0552),OU=Students,OU=SPC,DC=southplainscollege,DC=edu' . Notice the first User object found has the correct DN, with the comma in the CN= attribute escaped. This is the way the DN is stored in Active Directory. However, when doing the unfiltered search, the comma is no longer escaped resulting in the Invalid DN syntax. If I remove the membership_attribute and do the member checking in the group, I don¹t get the invalid DN (as the DN is no longer being searched), but the UserDn attribute is escaped differently rlm_ldap (ldap): Bind successful (11) User object found at DN "CN=Winders\, Tim (0552),OU=Students,OU=SPC,DC=southplainscollege,DC=edu" (11) Checking for user in group objects (11) EXPAND (&(objectClass=group)(member=%{control:Ldap-UserDn})) (11) --> (&(objectClass=group)(member=CN\3dWinders\2c Tim \280552\29\2cOU\3dStudents\2cOU\3dSPC\2cDC\3dsouthplainscollege\2cDC\3dedu) ) (11) Waiting for bind result... (11) Bind successful (11) Performing search in 'CN=Students Security Group,OU=Standard Groups,OU=Groups,OU=SPC,DC=southplainscollege,DC=edu' with filter '(&(objectClass=group)(member=CN\3dWinders\2c Tim \280552\29\2cOU\3dStudents\2cOU\3dSPC\2cDC\3dsouthplainscollege\2cDC\3dedu) )', scope 'sub' (11) Waiting for search result... (11) Search returned no results (11) Search returned not found Again, notice the successful user object found with the correct DN, but when doing the expansion of control:Ldap-UserDn the resulting DN is badly mangled. I found lots of information in the archives about UserDn escaping, but nothing current and no helpful information on how to fix this. Suggestions? -- Tim Winders Associate Dean of Information Technology South Plains College (806) 716-2369

6 18

Version 3.0.5 has been released
by Alan DeKok 21 Nov '14

21 Nov '14

We've added loads more regression tests, and a few nice features. Release notes are here: http://freeradius.org/version3.html * many more parts of the configuration are syntax checked when the server starts. * The detail file reader can now read a partial detail file, and then continue from where it left off * The couchbase module supports loading of dynamic clients * Better decoding of unknown VSAs * allow TLSv1.1 and TLSv1.2 in EAP. These can be selectively disabled. Other RADIUS implementations are doing the same. * escaping is now fixed. See "radiusd.conf", the "correct_escapes" setting. The last one is nice. It means you no longer need to use \\\\\\\\ in places. Just one escaping is good enough. Alan DeKok.

2 1

RE: Compare request:Calling-Station-Id with control:Calling-Station-Id
by Stabla, Daniel 21 Nov '14

21 Nov '14

The debug output (generated with radiusd -X ) says "everything" is fine. Maybe you will see an error/mistake anywhere: radiusd: FreeRADIUS Version 3.0.4, for host x86_64-unknown-linux-gnu, built on Nov 13 2014 at 15:39:48 Copyright (C) 1999-2014 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /tmp/test/share/freeradius/dictionary including dictionary file /tmp/test/share/freeradius/dictionary.dhcp including dictionary file /tmp/test/share/freeradius/dictionary.vqp including dictionary file /tmp/test/etc/raddb/dictionary including configuration file /tmp/test/etc/raddb/radiusd.conf including configuration file /tmp/test/etc/raddb/proxy.conf including configuration file /tmp/test/etc/raddb/clients.conf including files in directory /tmp/test/etc/raddb/mods-enabled/ including configuration file /tmp/test/etc/raddb/mods-enabled/detail including configuration file /tmp/test/etc/raddb/mods-enabled/cache_eap including configuration file /tmp/test/etc/raddb/mods-enabled/files including configuration file /tmp/test/etc/raddb/mods-enabled/exec including configuration file /tmp/test/etc/raddb/mods-enabled/digest including configuration file /tmp/test/etc/raddb/mods-enabled/radutmp including configuration file /tmp/test/etc/raddb/mods-enabled/dynamic_clients including configuration file /tmp/test/etc/raddb/mods-enabled/always including configuration file /tmp/test/etc/raddb/mods-enabled/expiration including configuration file /tmp/test/etc/raddb/mods-enabled/attr_filter including configuration file /tmp/test/etc/raddb/mods-enabled/realm including configuration file /tmp/test/etc/raddb/mods-enabled/eap including configuration file /tmp/test/etc/raddb/mods-enabled/logintime including configuration file /tmp/test/etc/raddb/mods-enabled/pap including configuration file /tmp/test/etc/raddb/mods-enabled/chap including configuration file /tmp/test/etc/raddb/mods-enabled/preprocess including configuration file /tmp/test/etc/raddb/mods-enabled/expr including configuration file /tmp/test/etc/raddb/mods-enabled/mschap including configuration file /tmp/test/etc/raddb/mods-enabled/echo including configuration file /tmp/test/etc/raddb/mods-enabled/cache including configuration file /tmp/test/etc/raddb/mods-enabled/passwd including files in directory /tmp/test/etc/raddb/policy.d/ including configuration file /tmp/test/etc/raddb/policy.d/filter including configuration file /tmp/test/etc/raddb/policy.d/control including configuration file /tmp/test/etc/raddb/policy.d/canonicalization including configuration file /tmp/test/etc/raddb/policy.d/eap including configuration file /tmp/test/etc/raddb/policy.d/debug including configuration file /tmp/test/etc/raddb/policy.d/dhcp including configuration file /tmp/test/etc/raddb/policy.d/operator-name including configuration file /tmp/test/etc/raddb/policy.d/accounting including configuration file /tmp/test/etc/raddb/policy.d/cui including files in directory /tmp/test/etc/raddb/sites-enabled/ including configuration file /tmp/test/etc/raddb/sites-enabled/inner-tunnel including configuration file /tmp/test/etc/raddb/sites-enabled/default main { security { allow_core_dumps = no } } main { name = "radiusd" prefix = "/tmp/test" localstatedir = "/tmp/test/var" sbindir = "/tmp/test/sbin" logdir = "/tmp/test/var/log/radius" run_dir = "/tmp/test/var/run/radiusd" libdir = "/tmp/test/lib" radacctdir = "/tmp/test/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/tmp/test/var/run/radiusd/radiusd.pid" checkrad = "/tmp/test/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } security { max_attributes = 200 reject_delay = 1 status_server = yes allow_vulnerable_openssl = "no" } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> shortname = "localhost" nas_type = "other" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } radiusd: #### Instantiating modules #### instantiate { } modules { # Loaded module rlm_detail # Instantiating module "detail" from file /tmp/test/etc/raddb/mods-enabled/detail detail { filename = "/tmp/test/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Loaded module rlm_cache # Instantiating module "cache_eap" from file /tmp/test/etc/raddb/mods-enabled/cache_eap cache cache_eap { key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 16384 epoch = 0 add_stats = no } # Loaded module rlm_files # Instantiating module "files" from file /tmp/test/etc/raddb/mods-enabled/files files { filename = "/tmp/test/etc/raddb/mods-config/files/authorize" usersfile = "/tmp/test/etc/raddb/mods-config/files/authorize" acctusersfile = "/tmp/test/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/tmp/test/etc/raddb/mods-config/files/pre-proxy" compat = "cistron" } reading pairlist file /tmp/test/etc/raddb/mods-config/files/authorize [/tmp/test/etc/raddb/mods-config/files/authorize]:181 Cistron compatibility checks for entry DEFAULT ... [/tmp/test/etc/raddb/mods-config/files/authorize]:188 Cistron compatibility checks for entry DEFAULT ... [/tmp/test/etc/raddb/mods-config/files/authorize]:195 Cistron compatibility checks for entry DEFAULT ... reading pairlist file /tmp/test/etc/raddb/mods-config/files/authorize [/tmp/test/etc/raddb/mods-config/files/authorize]:181 Cistron compatibility checks for entry DEFAULT ... [/tmp/test/etc/raddb/mods-config/files/authorize]:188 Cistron compatibility checks for entry DEFAULT ... [/tmp/test/etc/raddb/mods-config/files/authorize]:195 Cistron compatibility checks for entry DEFAULT ... reading pairlist file /tmp/test/etc/raddb/mods-config/files/accounting reading pairlist file /tmp/test/etc/raddb/mods-config/files/pre-proxy # Instantiating module "radius-station-init" from file /tmp/test/etc/raddb/mods-enabled/files files radius-station-init { usersfile = "/tmp/test/etc/raddb/radius-station-init" compat = "cistron" key = "%{Calling-Station-Id}" } reading pairlist file /tmp/test/etc/raddb/radius-station-init reading pairlist file /tmp/test/etc/raddb/radius-station-allow reading pairlist file /tmp/test/etc/raddb/radius-station-ids reading pairlist file /tmp/test/etc/raddb/radius-station-mac [/tmp/test/etc/raddb/radius-station-init]:5 Cistron compatibility checks for entry DEFAULT ... [/tmp/test/etc/raddb/radius-station-init]:7 Cistron compatibility checks for entry DEFAULT ... [/tmp/test/etc/raddb/radius-station-init]:25 Cistron compatibility checks for entry dstabla ... [/tmp/test/etc/raddb/radius-station-init]:5 Cistron compatibility checks for entry 11aa22-bb33cc ... [/tmp/test/etc/raddb/radius-station-init]:10 Cistron compatibility checks for entry DEFAULT ... # Loaded module rlm_exec # Instantiating module "exec" from file /tmp/test/etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_digest # Instantiating module "digest" from file /tmp/test/etc/raddb/mods-enabled/digest # Loaded module rlm_radutmp # Instantiating module "radutmp" from file /tmp/test/etc/raddb/mods-enabled/radutmp radutmp { filename = "/tmp/test/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_dynamic_clients # Instantiating module "dynamic_clients" from file /tmp/test/etc/raddb/mods-enabled/dynamic_clients # Loaded module rlm_always # Instantiating module "reject" from file /tmp/test/etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Instantiating module "fail" from file /tmp/test/etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Instantiating module "ok" from file /tmp/test/etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Instantiating module "handled" from file /tmp/test/etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Instantiating module "invalid" from file /tmp/test/etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Instantiating module "userlock" from file /tmp/test/etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Instantiating module "notfound" from file /tmp/test/etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Instantiating module "noop" from file /tmp/test/etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Instantiating module "updated" from file /tmp/test/etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_expiration # Instantiating module "expiration" from file /tmp/test/etc/raddb/mods-enabled/expiration # Loaded module rlm_attr_filter # Instantiating module "attr_filter.post-proxy" from file /tmp/test/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/tmp/test/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } reading pairlist file /tmp/test/etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /tmp/test/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/tmp/test/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } reading pairlist file /tmp/test/etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /tmp/test/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/tmp/test/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /tmp/test/etc/raddb/mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file /tmp/test/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/tmp/test/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } reading pairlist file /tmp/test/etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /tmp/test/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/tmp/test/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /tmp/test/etc/raddb/mods-config/attr_filter/accounting_response # Loaded module rlm_realm # Instantiating module "IPASS" from file /tmp/test/etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Instantiating module "suffix" from file /tmp/test/etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Instantiating module "realmpercent" from file /tmp/test/etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Instantiating module "ntdomain" from file /tmp/test/etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\" ignore_default = no ignore_null = no } # Loaded module rlm_eap # Instantiating module "eap" from file /tmp/test/etc/raddb/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no mod_accounting_username_bug = no max_sessions = 1024 } # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 ca_path = "/etc/radiusd/certs/" pem_file_type = yes private_key_file = "/etc/radiusd/certs/radius.pem" certificate_file = "/etc/radiusd/certs/radius.pem" private_key_password = <<< secret >>> dh_file = "/etc/radiusd/certs/dh" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = yes lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = yes } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_method = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Loaded module rlm_logintime # Instantiating module "logintime" from file /tmp/test/etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_pap # Instantiating module "pap" from file /tmp/test/etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_chap # Instantiating module "chap" from file /tmp/test/etc/raddb/mods-enabled/chap # Loaded module rlm_preprocess # Instantiating module "preprocess" from file /tmp/test/etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/tmp/test/etc/raddb/mods-config/preprocess/huntgroups" hints = "/tmp/test/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /tmp/test/etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /tmp/test/etc/raddb/mods-config/preprocess/hints # Loaded module rlm_expr # Instantiating module "expr" from file /tmp/test/etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } # Loaded module rlm_mschap # Instantiating module "mschap" from file /tmp/test/etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes } # Instantiating module "echo" from file /tmp/test/etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{Calling-Station-Id}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Instantiating module "cache" from file /tmp/test/etc/raddb/mods-enabled/cache cache { key = "%{User-Name}" ttl = 10 max_entries = 16384 epoch = 0 add_stats = no } # Loaded module rlm_passwd # Instantiating module "etc_passwd" from file /tmp/test/etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no } # modules radiusd: #### Loading Virtual Servers #### server { # from file /tmp/test/etc/raddb/radiusd.conf } # server server inner-tunnel { # from file /tmp/test/etc/raddb/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} Ignoring "sql" (see raddb/mods-available/README.rst) Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} } # server inner-tunnel server default { # from file /tmp/test/etc/raddb/sites-enabled/default # Creating Auth-Type = digest # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default server default2 { # from file /tmp/test/etc/raddb/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} } # server default2 radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipaddr = * port = 1645 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Listening on auth address 127.0.0.1 port 18120 as server inner-tunnel Listening on auth address * port 1812 as server default Listening on acct address * port 1813 as server default Listening on auth address :: port 1812 as server default Listening on acct address :: port 1813 as server default Listening on auth address * port 1645 as server default2 Opening new proxy socket 'proxy address * port 0' Listening on proxy address * port 57043 Ready to process requests Received Access-Request Id 168 from 192.168.0.1:3072 to 192.168.0.240:1812 length 200 User-Name = 'dstabla' Service-Type = Framed-User NAS-IP-Address = 192.168.0.1 NAS-Port = 1 NAS-Port-Id = '1' Called-Station-Id = 'XX-XX-XX-XX-XX-XX:WLAN TEST' Calling-Station-Id = '11-22-33-44-55-66' Connect-Info = 'CONNECT 144 Mbps 802.11g/n' NAS-Identifier = 'wpa' NAS-Port-Type = Wireless-802.11 Framed-MTU = 1500 EAP-Message = 0x0201000f015a445c64737461626c61 Message-Authenticator = 0x8e155265de6f1dee6dbfd87f96ab73af (0) Received Access-Request packet from host 192.168.0.1 port 3072, id=168, length=200 (0) User-Name = 'dstabla' (0) Service-Type = Framed-User (0) NAS-IP-Address = 192.168.0.1 (0) NAS-Port = 1 (0) NAS-Port-Id = '1' (0) Called-Station-Id = 'XX-XX-XX-XX-XX-XX:WLAN TEST' (0) Calling-Station-Id = '11-22-33-44-55-66' (0) Connect-Info = 'CONNECT 144 Mbps 802.11g/n' (0) NAS-Identifier = 'wpa' (0) NAS-Port-Type = Wireless-802.11 (0) Framed-MTU = 1500 (0) EAP-Message = 0x0201000f015a445c64737461626c61 (0) Message-Authenticator = 0x8e155265de6f1dee6dbfd87f96ab73af (0) # Executing section authorize from file /tmp/test/etc/raddb/sites-enabled/default (0) authorize { (0) EXPAND %{control:Calling-Station-Id} (0) --> #<=============================== missing, should be known from radius-station-ids (0) EXPAND %{control:NAS-Identifier} (0) --> #<=============================== missing, should be known from radius-station-ids (0) EXPAND %{request:Calling-Station-Id} (0) --> 11-22-33-44-55-66 (0) if (&request:Calling-Station-Id == &control:Calling-Station-Id) (0) if (&request:Calling-Station-Id == &control:Calling-Station-Id) -> FALSE (0) else else { (0) [reject] = reject (0) } # else else = reject (0) } # authorize = reject (0) Using Post-Auth-Type Reject (0) # Executing group from file /tmp/test/etc/raddb/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject : EXPAND %{User-Name} (0) attr_filter.access_reject : --> dstabla (0) attr_filter.access_reject : Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) eap : Request was previously rejected, inserting EAP-Failure (0) [eap] = updated (0) remove_reply_message_if_eap remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else else { (0) [noop] = noop (0) } # else else = noop (0) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sending Access-Reject packet to host 192.168.0.1 port 3072, id=168, length=0 (0) EAP-Message = 0x04010004 (0) Message-Authenticator = 0x00000000000000000000000000000000 Sending Access-Reject Id 168 from 192.168.0.240:1812 to 192.168.0.1:3072 EAP-Message = 0x04010004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds.

3 2

ERROR at testing freeradius
by Tania Romero 20 Nov '14

20 Nov '14

This is the first time I install and test Freeradius. This is the version of freeradius: -- freeradius -v freeradius: FreeRADIUS Version 2.1.10, for host i686-pc-linux-gnu, built on Feb 24 2014 at 15:16:51 Copyright (C) 1999-2010 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. This user is one of the default users, and I just uncommented that user line in /etc/freeradius/users: ******************************************************************************* # # Please read the documentation file ../doc/processing_users_file, # or 'man 5 users' (after installing the server) for more information. # # This file contains authentication security and configuration # information for each user. Accounting requests are NOT processed # through this file. Instead, see 'acct_users', in this directory. # # The first field is the user's name and can be up to # 253 characters in length. This is followed (on the same line) with # the list of authentication requirements for that user. This can # include password, comm server name, comm server port number, protocol # type (perhaps set by the "hints" file), and huntgroup name (set by # the "huntgroups" file). # # If you are not sure why a particular reply is being sent by the # server, then run the server in debugging mode (radiusd -X), and # you will see which entries in this file are matched. # # When an authentication request is received from the comm server, # these values are tested. Only the first match is used unless the # "Fall-Through" variable is set to "Yes". # # A special user named "DEFAULT" matches on all usernames. # You can have several DEFAULT entries. All entries are processed # in the order they appear in this file. The first entry that # matches the login-request will stop processing unless you use # the Fall-Through variable. # # If you use the database support to turn this file into a .db or .dbm # file, the DEFAULT entries _have_ to be at the end of this file and # you can't have multiple entries for one username. # # Indented (with the tab character) lines following the first # line indicate the configuration values to be passed back to # the comm server to allow the initiation of a user session. # This can include things like the PPP configuration values # or the host to log the user onto. # # You can include another `users' file with `$INCLUDE users.other' # # # For a list of RADIUS attributes, and links to their definitions, # see: # # http://www.freeradius.org/rfc/attributes.html # # # Deny access for a specific user. Note that this entry MUST # be before any other 'Auth-Type' attribute which results in the user # being authenticated. # # Note that there is NO 'Fall-Through' attribute, so the user will not # be given any additional resources. # #lameuser Auth-Type := Reject # Reply-Message = "Your account has been disabled." # # Deny access for a group of users. # # Note that there is NO 'Fall-Through' attribute, so the user will not # be given any additional resources. # #DEFAULT Group == "disabled", Auth-Type := Reject # Reply-Message = "Your account has been disabled." # # # This is a complete entry for "steve". Note that there is no Fall-Through # entry so that no DEFAULT entry will be used, and the user will NOT # get any attributes in addition to the ones listed here. # steve Cleartext-Password := "testing" # Service-Type = Framed-User, # Framed-Protocol = PPP, # Framed-IP-Address = 172.16.3.33, # Framed-IP-Netmask = 255.255.255.0, # Framed-Routing = Broadcast-Listen, # Framed-Filter-Id = "std.ppp", # Framed-MTU = 1500, # Framed-Compression = Van-Jacobsen-TCP-IP # # This is an entry for a user with a space in their name. # Note the double quotes surrounding the name. # #"John Doe" Cleartext-Password := "hello" # Reply-Message = "Hello, %{User-Name}" # # Dial user back and telnet to the default host for that port # #Deg Cleartext-Password := "ge55ged" # Service-Type = Callback-Login-User, # Login-IP-Host = 0.0.0.0, # Callback-Number = "9,5551212", # Login-Service = Telnet, # Login-TCP-Port = Telnet # # Another complete entry. After the user "dialbk" has logged in, the # connection will be broken and the user will be dialed back after which # he will get a connection to the host "timeshare1". # #dialbk Cleartext-Password := "callme" # Service-Type = Callback-Login-User, # Login-IP-Host = timeshare1, # Login-Service = PortMaster, # Callback-Number = "9,1-800-555-1212" # # user "swilson" will only get a static IP number if he logs in with # a framed protocol on a terminal server in Alphen (see the huntgroups file). # # Note that by setting "Fall-Through", other attributes will be added from # the following DEFAULT entries # #swilson Service-Type == Framed-User, Huntgroup-Name == "alphen" # Framed-IP-Address = 192.168.1.65, # Fall-Through = Yes # # If the user logs in as 'username.shell', then authenticate them # using the default method, give them shell access, and stop processing # the rest of the file. # #DEFAULT Suffix == ".shell" # Service-Type = Login-User, # Login-Service = Telnet, # Login-IP-Host = your.shell.machine # # The rest of this file contains the several DEFAULT entries. # DEFAULT entries match with all login names. # Note that DEFAULT entries can also Fall-Through (see first entry). # A name-value pair from a DEFAULT entry will _NEVER_ override # an already existing name-value pair. # # # Set up different IP address pools for the terminal servers. # Note that the "+" behind the IP address means that this is the "base" # IP address. The Port-Id (S0, S1 etc) will be added to it. # #DEFAULT Service-Type == Framed-User, Huntgroup-Name == "alphen" # Framed-IP-Address = 192.168.1.32+, # Fall-Through = Yes #DEFAULT Service-Type == Framed-User, Huntgroup-Name == "delft" # Framed-IP-Address = 192.168.2.32+, # Fall-Through = Yes # # Sample defaults for all framed connections. # #DEFAULT Service-Type == Framed-User # Framed-IP-Address = 255.255.255.254, # Framed-MTU = 576, # Service-Type = Framed-User, # Fall-Through = Yes # # Default for PPP: dynamic IP address, PPP mode, VJ-compression. # NOTE: we do not use Hint = "PPP", since PPP might also be auto-detected # by the terminal server in which case there may not be a "P" suffix. # The terminal server sends "Framed-Protocol = PPP" for auto PPP. # DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP # # Default for CSLIP: dynamic IP address, SLIP mode, VJ-compression. # DEFAULT Hint == "CSLIP" Framed-Protocol = SLIP, Framed-Compression = Van-Jacobson-TCP-IP # # Default for SLIP: dynamic IP address, SLIP mode. # DEFAULT Hint == "SLIP" Framed-Protocol = SLIP # # Last default: rlogin to our main server. # #DEFAULT # Service-Type = Login-User, # Login-Service = Rlogin, # Login-IP-Host = shellbox.ispdomain.com # # # # Last default: shell on the local terminal server. # # # DEFAULT # Service-Type = Administrative-User # On no match, the user is denied access. ******************************************************************************* I have a terminal where I see the debugging messages, and another where I entered the following commands: -- radtest steve testing 127.0.0.1 0 testing123 This is the outcome: Sending Access-Request Id 79 from 0.0.0.0:37440 to 127.0.0.1:1812 User-Name = 'steve' User-Password = 'testing' NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Message-Authenticator = 0x00 Received Access-Reject Id 79 from 127.0.0.1:1812 to 127.0.0.1:37440 length 20 (0) -: Expected Access-Accept got Access-Reject In the debug console, this is the result: ******************************************************************************* rad_recv: Access-Request packet from host 127.0.0.1 port 37440, id=79, length=75 User-Name = "steve" User-Password = "testing" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Message-Authenticator = 0x57890edab06058e2770c96eea02e0d0a # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "steve", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> steve attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 22 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 22 Sending Access-Reject of id 79 to 127.0.0.1 port 37440 Waking up in 4.9 seconds. Cleaning up request 22 ID 79 with timestamp +9927 Ready to process requests. ******************************************************************************* I'm not sure if that's the file where I have to enable the "steve" user, because for what I've read this line: ++[files] returns noop Indicates that Freeradius hasn't found my user configuration. Is it possible that I've been configuring the wrong file? Any other ideas of why Freeradius keeps rejecting my request?

4 4

Re:NAP
by Zulzig 20 Nov '14

20 Nov '14

Hey Alan, i have tested your suggestion, but i'm in front of the same bug, that i said in my last message. the radius server send to the switch the incorrect information.. it send the last valor instead of to use the new. may be i need to upgrade my version to the 2.2.5 or I missed something. thank

2 1

RE:NAP with Freeradius
by Zulzig 20 Nov '14

20 Nov '14

Hey Alan, i have tested your suggestion, but i'm in front of the same bug, that i said in my last message. the radius server send to the switch the incorrect information.. it send the last valor instead of to use the new. may be i need to upgrade my version to the 2.2.5 or I missed something. thank

1 0

Compare request:Calling-Station-Id with control:Calling-Station-Id
by Stabla, Daniel 20 Nov '14

20 Nov '14

Hello, we have a problem that the check if (&request:Calling-Station-Id == &control:Calling-Station-Id) fails, because control:Calling-Station-Id is empty in freeradius 3.0.x. We have a file which contains a list like this one: userXNAS-Identifier =~ "someAP*", Calling-Station-Id += "00-11-22-33-44-55" userX2NAS-Identifier =~ "someAP*", Calling-Station-Id += "00-12-23-34-45-56" and this works well with checkval on freeradius 2.x So what do we need to get this to work with freeradius 3.x ? Kind regards. D. Stabla

2 1