April 2016 - Freeradius-Users - lists.freeradius.org

Freeradius 2.2.9 not works
by Mr Dini 04 Apr '16

04 Apr '16

Hi! I compiled the freeradius 2.2.9 on my nas and I configured a MySQL database for radius. It seems like works, but if I make a test connection from my router, it sends an Access-Reject package... If I make a radtest it also sends Access-Reject package, but if I edit the Cleartext-Password := guest1234 to Password == guest1234 it sends Access-Accept package... Why? What's wrong? Thanks for your answer!

2 3

New Install
by Cameron Murray 04 Apr '16

04 Apr '16

Guys, First time member and have a slight issue. Fresh Centos 6.7 64bit install and Freeradius installed with a remote MySQL server. Service launches perfectly in debug and daemon however it does not appear to be listening correctly. Netstat -a shows Radius and Radius Account open on * however when I query radius with radtest or radping it sees no data. udp 0 0 *:radius *:* udp 0 0 *:radius-acct *:* Iptables has been disabled and confirmed after reboot. I've tested radping from localhost and the Mysql Server with the same result: radtest test test 192.168.0.250 1812 123456789 Sending Access-Request of id 15 to 192.168.0.250 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 192.168.10.251 NAS-Port = 1812 Message-Authenticator = 0x00000000000000000000000000000000 Sending Access-Request of id 15 to 192.168.0.250 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 192.168.10.251 NAS-Port = 1812 Message-Authenticator = 0x00000000000000000000000000000000 Sending Access-Request of id 15 to 192.168.0.250 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 192.168.10.251 NAS-Port = 1812 Message-Authenticator = 0x00000000000000000000000000000000 radclient: no response from server for ID 15 socket 3 Is there a secret to make it listen correctly? TIA. Cameron

2 1

chap info freeradius 2.1.12
by khouzam yaghi 04 Apr '16

04 Apr '16

what does the info in the radius log means rarely i am getting this info in the radius log Auth: [chap] rlm_chap: Attribute "User-Name" is required for authentication.

2 1

No EAP response
by TOURE Amidou Florian 04 Apr '16

04 Apr '16

Hi all,I'm configuring a Network Access Control Solution (Packetfence ) but i have a problem to authenticate my users.I hope that someone will be able to help me.-I have a windows 2008 Active Directory for my users -I'm using a cisco 2950 switch to authenticate my users but when connecting a host i get this error on my switch,It seems like the switch cannot reach the server but i'm sure that the radius server ip address is 192.168.10.1 : RADIUS: Retransmit id 4 00:28:11: RADIUS: Retransmit id 4 00:28:13: RADIUS: Retransmit id 4 00:28:15: RADIUS: Marking server 192.168.10.1:1812,1813 dead 00:28:15: RADIUS: Tried all servers. 00:28:15: RADIUS: No valid server found. Trying any viable server 00:28:15: RADIUS: Tried all servers. 00:28:15: RADIUS: No response for id 4 00:28:15: AAA/AUTHEN (3539210218): status = ERROR 00:28:15: AAA/AUTHEN/START (3539210218): no methods left to try 00:28:15: AAA/AUTHEN (3539210218): status = ERROR 00:28:15: AAA/AUTHEN/START (3539210218): failed to authenticate 00:28:15: AAA/MEMORY: free_user_quiet (0x80D4E810) user='Prof-PC\Prof' ruser='Prof-PC\Prof' port='FastEthernet0/2' rem_addr='00-40-D0-67-D0-B1/00-18-BA-9B-E7-82' authen_type=6 service=17 priv=1 This is my swicth configuration here : Building configuration... Current configuration : 2480 bytes!version 12.1no service pad service timestamps debug uptime service timestamps log uptime no service password-encryption!hostname Switch!aaa new-modelaaa group server radius packetfence server 192.168.10.1 auth-port 1812 acct-port 1813!aaa authentication login default local aaa authentication dot1x default group packetfence aaa authorization network default group packetfence!username admin password 0 thegame ip subnet-zero!!spanning-tree mode pvst no spanning-tree optimize bpdu transmission spanning-tree extend system-id dot1x system-auth-control!!!!interface FastEthernet0/1 switchport trunk native vlan 10 switchport trunk allowed vlan 1,10,20,30,40,60,100 switchport mode trunk !interface FastEthernet0/2 switchport access vlan 4 switchport mode access dot1x port-control auto dot1x host-mode multi-host dot1x reauthentication spanning-tree portfast!interface FastEthernet0/3!interface FastEthernet0/4!interface FastEthernet0/5!interface FastEthernet0/6!interface FastEthernet0/7!interface FastEthernet0/8!interface FastEthernet0/9!interface FastEthernet0/10!interface FastEthernet0/11!interface FastEthernet0/12!interface FastEthernet0/13!interface FastEthernet0/14!interface FastEthernet0/15!interface FastEthernet0/16!interface FastEthernet0/17!interface FastEthernet0/18!interface FastEthernet0/19!interface FastEthernet0/20!interface FastEthernet0/21!interface FastEthernet0/22!interface FastEthernet0/23!interface FastEthernet0/24!interface Vlan1 no ip address no ip route-cache shutdown!interface Vlan4 ip address 192.168.4.1 255.255.255.0 no ip route-cache shutdown!interface Vlan10 ip address 192.168.1.5 255.255.255.0 ip helper-address 192.168.10.1 no ip route-cache!interface Vlan20 ip address 192.168.20.1 255.255.255.0 no ip route-cache shutdown!interface Vlan30 ip address 192.168.30.1 255.255.255.0 no ip route-cache shutdown!interface Vlan40 ip address 192.168.40.1 255.255.255.0 no ip route-cache shutdown!interface Vlan50 no ip address no ip route-cache shutdown!interface Vlan60 ip address 192.168.60.1 255.255.255.0 no ip route-cache shutdown!interface Vlan100 ip address 192.168.100.1 255.255.255.0 no ip route-cache shutdown! ip http server radius-server host 192.168.10.1 auth-port 1812 acct-port 1813 timeout 2 key thegame radius-server retransmit 3 radius-server vsa send authentication!line con 0line vty 5 15!!end

3 2

No EAP response
by TOURE Amidou Florian 04 Apr '16

04 Apr '16

Hi all,I'm configuring a Network Access Control Solution (Packetfence ) but i have a problem to authenticate my users.I hope that someone will be able to help me.-I have a windows 2008 Active Directory for my users -I'm using a cisco 2950 switch to authenticate my users but when connecting a host i get this error on my switch,It seems like the switch cannot reach the server but i'm sure that the radius server ip address is 192.168.10.1 : RADIUS: Retransmit id 400:28:11: RADIUS: Retransmit id 400:28:13: RADIUS: Retransmit id 400:28:15: RADIUS: Marking server 192.168.10.1:1812,1813 dead00:28:15: RADIUS: Tried all servers.00:28:15: RADIUS: No valid server found. Trying any viable server00:28:15: RADIUS: Tried all servers.00:28:15: RADIUS: No response for id 400:28:15: AAA/AUTHEN (3539210218): status = ERROR00:28:15: AAA/AUTHEN/START (3539210218): no methods left to try00:28:15: AAA/AUTHEN (3539210218): status = ERROR00:28:15: AAA/AUTHEN/START (3539210218): failed to authenticate00:28:15: AAA/MEMORY: free_user_quiet (0x80D4E810) user='Prof-PC\Prof' ruser='Prof-PC\Prof' port='FastEthernet0/2' rem_addr='00-40-D0-67-D0-B1/00-18-BA-9B-E7-82' authen_type=6 service=17 priv=1 This is my swicth configuration here : Building configuration... Current configuration : 2480 bytes!version 12.1no service padservice timestamps debug uptimeservice timestamps log uptimeno service password-encryption!hostname Switch!aaa new-modelaaa group server radius packetfence server 192.168.10.1 auth-port 1812 acct-port 1813!aaa authentication login default localaaa authentication dot1x default group packetfenceaaa authorization network default group packetfence!username admin password 0 thegameip subnet-zero!!spanning-tree mode pvstno spanning-tree optimize bpdu transmissionspanning-tree extend system-iddot1x system-auth-control!!!!interface FastEthernet0/1 switchport trunk native vlan 10 switchport trunk allowed vlan 1,10,20,30,40,60,100 switchport mode trunk!interface FastEthernet0/2 switchport access vlan 4 switchport mode access dot1x port-control auto dot1x host-mode multi-host dot1x reauthentication spanning-tree portfast!interface FastEthernet0/3!interface FastEthernet0/4!interface FastEthernet0/5!interface FastEthernet0/6!interface FastEthernet0/7!interface FastEthernet0/8!interface FastEthernet0/9!interface FastEthernet0/10!interface FastEthernet0/11!interface FastEthernet0/12!interface FastEthernet0/13!interface FastEthernet0/14!interface FastEthernet0/15!interface FastEthernet0/16!interface FastEthernet0/17!interface FastEthernet0/18!interface FastEthernet0/19!interface FastEthernet0/20!interface FastEthernet0/21!interface FastEthernet0/22!interface FastEthernet0/23!interface FastEthernet0/24!interface Vlan1 no ip address no ip route-cache shutdown!interface Vlan4 ip address 192.168.4.1 255.255.255.0 no ip route-cache shutdown!interface Vlan10 ip address 192.168.1.5 255.255.255.0 ip helper-address 192.168.10.1 no ip route-cache!interface Vlan20 ip address 192.168.20.1 255.255.255.0 no ip route-cache shutdown!interface Vlan30 ip address 192.168.30.1 255.255.255.0 no ip route-cache shutdown!interface Vlan40 ip address 192.168.40.1 255.255.255.0 no ip route-cache shutdown!interface Vlan50 no ip address no ip route-cache shutdown!interface Vlan60 ip address 192.168.60.1 255.255.255.0 no ip route-cache shutdown!interface Vlan100 ip address 192.168.100.1 255.255.255.0 no ip route-cache shutdown!ip http serverradius-server host 192.168.10.1 auth-port 1812 acct-port 1813 timeout 2 key thegameradius-server retransmit 3radius-server vsa send authentication!line con 0line vty 5 15!!end

3 3

Freeradius Max-Daily-Session in custom authentication
by Polarix 01 Apr '16

01 Apr '16

Actually i have AAA by mysql and everything work fine. Especially the use *Max-Daily-Session*attribute to disconnect the user after 10min (600sec) connection. I recently changed the way authenticazione using a custom php script. In sites-enabled/default file: authorize{ update control { Auth-Type := `/usr/bin/php -f /etc/raddb/yourscript.php '%{User-Name}' '%{User-Password}' '%{Client-IP-Address}'`} In /etc/freeradius/users: DEFAULT Auth-Type = AcceptExec-Program-Wait = "/usr/bin/php -f /etc/raddb/attributes.php '%{User-Name}' '%{User-Password}' '%{Client-IP-Address}'" In attributes.php: <?php $User = $argv[1]; $Pass = $argv[2]; $Ip = $argv[3];if ($User == "test") echo "Max-Daily-Session:=600";?> It seems that the server does not care about the Max-Daily-Session attribute and does not send the Packet of Disconnect. What changes between mysql and custom authentication?

2 4

audispd stopping radiusd due to memory violation
by Christopher Michael Allison 01 Apr '16

01 Apr '16

I am seeing this happen on one of our radius servers. We are running FreeRADIUS 3.0.11. This started happening more frequently on one of our radius. Yesterday has been the most it has done it. It was 3 times in like a 6 hour period. We had this issue when I first upgraded our servers to 3.0.11 but I found another avenue that this was due to and it was that the MozNSS compile openldap libraries were causing this issue. I have since fixed that I have compiled openldap based upon openssl and this has stopped happening on all our other servers. This one server keeps dying because of a memory violation. The error message follows: audispd[902]: node="radius-server-hostname" type=ANOM_ABEND msg=audit(1459467717.181:189187): auid=4294967295 uid=977 gid=2010 ses=4294967295 subj=system_u:system_r:unconfined_service_t:s0 pid=40239 comm="radiusd" reason="memory violation" sig=11 Thanks, CHRISTOPHER ALLISON Network Engineer I Information Technology Mail Code 4622 625 Wham Drive Carbondale, Illinois 62901 chris.m.allison(a)siu.edu<mailto:%20chris.m.allison@siu.edu> M - F 7:30 AM - 4 PM P: 618 / 453 - 8415 F: 618 / 453 - 5261 INFOTECH.SIU.EDU<http://infotech.siu.edu/> [http://asset.siu.edu/_assets/images/email_sig/SIU_email_2line.gif] "Choose a job you love, and you will never have to work a day in your life." Confucius

3 2

OCSP URL format
by Alex Sharaz 01 Apr '16

01 Apr '16

Quick question about OCSP URLs. When overriding the cert specified OCSP URL, can you specify more than one just in case a server dies for example? Just been off site and our F5 that load balances requests to our OCSP service decided not to forward them hence the only way to connect to eduroam was to delete the TLS profile and use PEAP. Talking to all the individual OCSP servers worked just fine. Rgds Alex

5 11