June 2014 - Freeradius-Users - lists.freeradius.org

authentication eap-sim to AP is failed
by Muhammad Hasan 30 Jun '14

30 Jun '14

hi, I tried eap-sim authentication on freeradius-server 2.2.0, I followed the steps from https://code.google.com/p/seek-for-android/wiki/EapSimAka I've added lines on the clients.conf client 192.168.1.0/24 { secret = eap-sim shortname = eap-sim } In the config directory /etc/freeradius/modules create a file sim_files with following content: sim_files { simtriplets = "/etc/freeradius/simtriplets.dat" } and then I made the simtrilplets.dat with the same format In the config file default add sim_files directly before eap { ok = return } IP address for AP is 192.168.1.1/24 and I've set up the IP server radius on AP too but I always failed when I was tried to connect AP. This is the log from freeradius -X server { # from file /etc/freeradius/radiusd.conf modules { Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/freeradius/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/freeradius/huntgroups reading pairlist file /etc/freeradius/hints Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_sim_files Module: Instantiating module "sim_files" from file /etc/freeradius/modules/sim_files sim_files { simtriplets = "/etc/freeradius/simtriplets.dat" } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius/modules/files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } reading pairlist file /etc/freeradius/users [/etc/freeradius/users]:205 WARNING! Check item "EAP-Sim-Rand1" found in reply item list for user " 1510101425520064(a)wlan.mnc010.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:205 WARNING! Check item "EAP-Sim-SRES1" found in reply item list for user " 1510101425520064(a)wlan.mnc010.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:205 WARNING! Check item "EAP-Sim-KC1" found in reply item list for user " 1510101425520064(a)wlan.mnc010.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:205 WARNING! Check item "EAP-Sim-Rand2" found in reply item list for user " 1510101425520064(a)wlan.mnc010.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:205 WARNING! Check item "EAP-Sim-SRES2" found in reply item list for user " 1510101425520064(a)wlan.mnc010.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:205 WARNING! Check item "EAP-Sim-KC2" found in reply item list for user " 1510101425520064(a)wlan.mnc010.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:205 WARNING! Check item "EAP-Sim-Rand3" found in reply item list for user " 1510101425520064(a)wlan.mnc010.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:205 WARNING! Check item "EAP-Sim-SRES3" found in reply item list for user " 1510101425520064(a)wlan.mnc010.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:205 WARNING! Check item "EAP-Sim-KC3" found in reply item list for user " 1510101425520064(a)wlan.mnc010.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items reading pairlist file /etc/freeradius/acct_users reading pairlist file /etc/freeradius/preproxy_users Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/freeradius/modules/detail detail { detailfile = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/attrs.access_reject } # modules } # server server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 54196 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.1 port 2049, id=132, length=171 User-Name = "eap-sim" NAS-IP-Address = 192.168.1.1 NAS-Port = 0 Called-Station-Id = "004f62248f98" Calling-Station-Id = "742f68c46785" NAS-Identifier = "Realtek Access Point. 8186" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200000c016561702d73696d Message-Authenticator = 0x3fc1d6636e4f6270a431b3458ca06ff5 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "eap-sim", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop rlm_sim_files: insufficient number of challenges for imsi eap-sim: 0 ++[sim_files] returns notfound [eap] EAP packet type response id 0 length 12 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 132 to 192.168.1.1 port 2049 EAP-Message = 0x01010016041094f4cc2024e119239db0e6579b1f5000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x070274880703701220c8065c4d562119 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.1 port 2049, id=133, length=177 User-Name = "eap-sim" NAS-IP-Address = 192.168.1.1 NAS-Port = 0 Called-Station-Id = "004f62248f98" Calling-Station-Id = "742f68c46785" NAS-Identifier = "Realtek Access Point. 8186" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020100060319 State = 0x070274880703701220c8065c4d562119 Message-Authenticator = 0x12c4442b5144c87463b38e4a0e7af81c # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "eap-sim", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop rlm_sim_files: insufficient number of challenges for imsi eap-sim: 0 ++[sim_files] returns notfound [eap] EAP packet type response id 1 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/peap [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 133 to 192.168.1.1 port 2049 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0702748806006d1220c8065c4d562119 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.1 port 2049, id=134, length=276 User-Name = "eap-sim" NAS-IP-Address = 192.168.1.1 NAS-Port = 0 Called-Station-Id = "004f62248f98" Calling-Station-Id = "742f68c46785" NAS-Identifier = "Realtek Access Point. 8186" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0202006919800000005f160301005a01000056030153ae915307b8e4203173c673c2b25d2a4e6b9186ba795b25c232a4cb0b2d58f6000018002f00350005000ac013c014c009c00a003200380013000401000015ff01000100000a0006000400170018000b00020100 State = 0x0702748806006d1220c8065c4d562119 Message-Authenticator = 0xc9f772337a828d723bc827c712d5b361 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "eap-sim", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop rlm_sim_files: insufficient number of challenges for imsi eap-sim: 0 ++[sim_files] returns notfound [eap] EAP packet type response id 2 length 105 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 95 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 005a], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 0031], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 01a7], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 134 to 192.168.1.1 port 2049 EAP-Message = 0x010301f1190016030100310200002d030153ae915b02a6f72ded54f9c6f1fd36d34278cc2efd025157791742c03da6416600002f000005ff0100010016030101a70b0001a30001a000019d3082019930820102020900d8625c5bc9f7dcdc300d06092a864886f70d01010505003011310f300d060355040313067562756e7475301e170d3134303631373231303330305a170d3234303631343231303330305a3011310f300d060355040313067562756e747530819f300d06092a864886f70d010101050003818d0030818902818100c374d82d8a75bcc5b948020edb08c1d5bb3c880070ff573d4523b4d27afccc380eef50e010727c0860217182c1 EAP-Message = 0xd1608f21ed0adeeb17c1d6a6946c4fdd99876fc1fba94da1bbe1816ff176f1d46caa3fc5fb936f37fae2104213f40a87605b7ce29826aaceab75b9e91aeafa898c51252971bd690f700e5e509bfc4f0cbc51390203010001300d06092a864886f70d0101050500038181003a6ef824822c58464dcccacd831ab2cbe98a01f15f28e0047fbdf16fcf265a40ba086ca72e426e13e28e1e3f7df57ad6b87895651f888580feef1a11f84a74b55578d7e014d31eaeaa75c8d38fa0bfd0f5be3f80b7dbd5c8f0c07111d3ed7790338674c3ef6490db3ac40f20ddf2e6e011c0c4a0520c6d39fec268f451c6555716030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0702748805016d1220c8065c4d562119 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.1 port 2049, id=135, length=188 User-Name = "eap-sim" NAS-IP-Address = 192.168.1.1 NAS-Port = 0 Called-Station-Id = "004f62248f98" Calling-Station-Id = "742f68c46785" NAS-Identifier = "Realtek Access Point. 8186" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0203001119800000000715030100020230 State = 0x0702748805016d1220c8065c4d562119 Message-Authenticator = 0xe4144d90ba1800e0b07281e4745189d8 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "eap-sim", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop rlm_sim_files: insufficient number of challenges for imsi eap-sim: 0 ++[sim_files] returns notfound [eap] EAP packet type response id 3 length 17 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 7 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert read:fatal:unknown CA TLS_accept: failed in SSLv3 read client certificate A rlm_eap: SSL error error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca SSL: SSL_read failed inside of TLS (-1), TLS session fails. TLS receive handshake failed during operation [peap] eaptls_process returned 4 [peap] EAPTLS_OTHERS [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> eap-sim attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 3 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 3 Sending Access-Reject of id 135 to 192.168.1.1 port 2049 EAP-Message = 0x04030004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. Cleaning up request 0 ID 132 with timestamp +8 Cleaning up request 1 ID 133 with timestamp +8 Cleaning up request 2 ID 134 with timestamp +8 Waking up in 1.0 seconds. Cleaning up request 3 ID 135 with timestamp +8 Ready to process requests. where is the problem? I really new on freeradius thank you -- Best Regards,

3 5

Re: authentication eap-sim to AP is failed
by Mitch Yackobeck 30 Jun '14

30 Jun '14

1 0

Proxy: No Outstanding Request
by rvw＠i2k.com 30 Jun '14

30 Jun '14

Running Radius 2.1.6. I am proxying to the server x.x.x.x shown below and I keep getting these messages in radius.log Mon Jun 30 14:02:08 2014 : Proxy: No outstanding request was found for reply from host x.x.x.x port 1648 - ID 51 Mon Jun 30 14:02:10 2014 : Proxy: No outstanding request was found for reply from host x.x.x.x port 1648 - ID 81 Mon Jun 30 14:02:17 2014 : Proxy: No outstanding request was found for reply from host x.x.x.x port 1648 - ID 128 What causes this? How is it fixed? Thanks, RonVW

2 1

users file syntax
by Krzysztof Grobelak 30 Jun '14

30 Jun '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello List, Recently i set up another freeRADIUS server with version 3.0.3. I configured FR to use Active Directory as backend and use ntlm_auth to authenticate users. Then, after successful authentication FR scans the users file to check for attributes for given user. Therefore the users file looked as follows: user1 Attr-One = "Bar", Attr-Two = "Foo", Attr-Three = "Baz" The Cleartext-Password is missing from the same line as username because it is not needed there since user was already authenticated against AD. This syntax does not work in the 3.0.3 version. Radiusd -X stops with folowing error: /usr/local/etc/raddb/users.login.network.devices[17]: Parse error (check) for entry user1: Invalid vendor name in attribute name "" Is this intended change and if yes what should be the proper syntax now. Regards, Krzysztof -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.13 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBAgAGBQJTsSoiAAoJEM/U1HoKR/xk1T8H/1ZdqFmkNmjhLG+8FwoZOb70 1h5ghhjfmAugbLcQX5gDrYcLloZ+TLA0twNjAVvrpVgKc0fVto1X/pnqkMGLgqza p0YUdNlGiQ1h1MO4gbIXZT0HTBMqvCkWli7pyY5otMnLQv0qlnKfZVOxW1p/rNPg emo/M+3fMroTLu0dIAe7WuCmcKPfT4nI7Lm3EZR8mDqjekiyi2RbkAZ3PIUQejBp CZeCO+/W0DGP777cyKKuG1eKkUGKBwAT/YGWFWqS+U5GmUss/tEmXxm1mw5s3aiV hL3qPLl7YdxXJuFQ1RrPWFLxh0SP1dDbpdlpf/m3fbbm5vugEdnRRcVgU62tQhA= =0/Yr -----END PGP SIGNATURE----- Airspeed Telecom

2 2

Google Authenticator with OpenVPN and FreeRadius
by Kevin MELKA 28 Jun '14

28 Jun '14

Hello everybody, Could you explain me how do i do to use Google Authenticator with OpenVPN and FreeRadius ? I find any things in Internet but nothing interesting. I use Ubuntu 12.04 and i use this packet : libpam-google-authenticator 20110413.68230188bdc7-1.1 Thanks you in advance. Have a nice day, greenkev

1 0

[ANN] New logo
by Arran Cudbard-Bell 28 Jun '14

28 Jun '14

The new logo has officially been deployed. See it in its radial glory here: http://www.freeradius.org If you find any places still using the old logo, correct them if you can, else ping one of the core team off list. If you need a scalable version for whatever reason (or a different sized image), the SVG is available here: http://freeradius.org/images/logo.svg Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

2 1

Cannot insert duplicate key row in object 'dbo.radacct' with unique index 'AcctUniqueId'
by info Redlibre 27 Jun '14

27 Jun '14

Hello, i'am using freeradius 2.1.12+dfsg-1.2 on debian wheezy, AAA is in MS-SQL backend using iodbc, the system is a hotspot with mikrotik routerboard using radius client, everything is fine the users can authenticate from radcheck table but in accounting log i receive this message Error: sql_query: failed: [FreeTDS][SQL Server]Cannot insert duplicate key row in object 'dbo.radacct' with unique index 'AcctUniqueId'. The duplicate key value is (4785db03c.... the problem is the radacct table is not registering info like, acctstoptime, acctsessiontime and others, only acctstarttime if i modify the index unique of acctuniqueid like not unique is worst because in radacct table the start time and stoptime is inserted in two different rows i'm using the following schema https://github.com/FreeRADIUS/freeradius-server/blob/master/raddb/mods-conf… and the query from https://github.com/FreeRADIUS/freeradius-server/blob/master/raddb/mods-conf… by the way i had to modified the query.conf file because there is an error in variable NASPortId column, it is called from query.conf by NASPort , anyway my problem is the radacct table is not registering info like, acctstoptime, acctsessiontime and others I am wondering if can i use the mysql query file to achieve this? (obviously, making a little changes into querys ) for example i've put the postauth definition from mysql on mssql and it works. before always i've used freeradius + mysql and accounting is fine, unfortunately at this time i have to use MSSQL like backend, is not my fault ;) regards pablou

2 1

Is it possible to do Auth, Accounting and COA over single client initiated RADSEC session?
by Smc Kms 27 Jun '14

27 Jun '14

Dear FreeRadius users and developers. I'm working on a project where we need client devices to connect to our FreeRadius server over the internet using a single RADSEC connection that each client device would initiate. We would like all radius traffic to go over this single connection including Auth, Accounting, and COA messages. I have been working with the TLS configuration and see that it supports Auth+Acct only, and so far I have not figured out how to get COA messages to go back down the same connection. Is this already supported by FreeRadius, and how would I configure my server to support it? If this is not currently supported, is this a feature that is in consideration for future development? I would be thankful for any advice. Kind Regards Craig. --- This email is free from viruses and malware because avast! Antivirus protection is active. http://www.avast.com

3 5

segfault in 2.2.5 comparing Client-IP-Address
by Harald Terkelsen 27 Jun '14

27 Jun '14

Hi, When we changed a check from "if (<some other checks> || NAS-IP-Address == xxx.xxx.xxx.xxx)" to "if (<some other checks> || Client-IP-Address == xxx.xxx.xxx.xxx)", Freeradius 2.2.5 segfaults. gdb: ? Evaluating (NAS-IP-Address == xxx.xxx.xxx.xxx ) -> FALSE expand: %{Client-IP-Address} -> Program received signal SIGSEGV, Segmentation fault. paircmp (one=0x7ffff8454760, two=0x0) at valuepair.c:2036 2036 compare = ntohl(two->vp_ipaddr) - ntohl(one->vp_ipaddr); It looks like the segfault happens when Freeradius receives a request from a NAS using IPv6. We did not see the segfault when the Client-IP-Address was an IPv4 address in the tests we did. Same problem with Packet-Src-IP-Address. Regards, Harald Terkelsen Oslo and Akershus University College of Applied Sciences

1 0

RADIUS, anycast, and high availability
by Jason Healy 27 Jun '14

27 Jun '14

Hello all, We’re looking into using anycast and a group of servers for some of our stateless services (like DNS and NTP) to increase availability, as anycast “automatically” routes traffic to one machine in a group. I’m wondering if RADIUS is a good candidate for this as well. Being UDP-based is a good start, but I don’t know if the servers will get annoyed if (say) multiple packets in an EAP conversation don’t go to the same server. DNS is much simpler as its usually single-shot (request -> reply). Basically: has anyone else tried it? Or is this a Bad Idea and I just stick to regular multi-server with failover on the NAS? Thanks, Jason

6 8