- Freeradius-Users - lists.freeradius.org

MAC auth with checkval - No authenticate method (Auth-Type)
by blouman176 02 Feb '12

02 Feb '12

Hello all, I'm trying to authenticate workstations with their MAC address. Here my problem during authenticate : rad_recv: Access-Request packet from host 192.168.64.5 port 5001, id=138, length=136 User-Name = "00-15-c5-b2-d7-f1" User-Password = "00-15-c5-b2-d7-f1" NAS-IP-Address = 192.168.64.5 NAS-Identifier = "3822d6bed9f0" NAS-Port = 16961538 NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "00-15-C5-B2-D7-F1" Thu Feb 2 09:15:15 2012 : Info: +- entering group authorize {...} Thu Feb 2 09:15:15 2012 : Info: ++[preprocess] returns ok Thu Feb 2 09:15:15 2012 : Info: [files] users: Matched entry 00-15-c5-b2-d7-f1 at line 1 Thu Feb 2 09:15:15 2012 : Info: ++[files] returns ok Thu Feb 2 09:15:15 2012 : Debug: rlm_checkval: Item Name: Calling-Station-Id, Value: 00-15-C5-B2-D7-F1 Thu Feb 2 09:15:15 2012 : Debug: rlm_checkval: Value Name: Calling-Station-Id, Value: 00-15-C5-B2-D7-F1 Thu Feb 2 09:15:15 2012 : Info: ++[checkval] returns ok Thu Feb 2 09:15:15 2012 : Info: ++[expiration] returns noop Thu Feb 2 09:15:15 2012 : Info: ++[logintime] returns noop Thu Feb 2 09:15:15 2012 : Info: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Thu Feb 2 09:15:15 2012 : Info: Failed to authenticate the user. Thu Feb 2 09:15:15 2012 : Info: Using Post-Auth-Type Reject Thu Feb 2 09:15:15 2012 : Info: +- entering group REJECT {...} Thu Feb 2 09:15:15 2012 : Info: [attr_filter.access_reject] expand: %{User-Name} -> 00-15-c5-b2-d7-f1 Thu Feb 2 09:15:15 2012 : Debug: attr_filter: Matched entry DEFAULT at line 11 Thu Feb 2 09:15:15 2012 : Info: ++[attr_filter.access_reject] returns updated Thu Feb 2 09:15:15 2012 : Info: Delaying reject of request 0 for 1 seconds Thu Feb 2 09:15:15 2012 : Debug: Going to the next request Thu Feb 2 09:15:15 2012 : Debug: Waking up in 0.9 seconds. Thu Feb 2 09:15:16 2012 : Info: Sending delayed reject for request 0 Sending Access-Reject of id 138 to 192.168.64.5 port 5001 Thu Feb 2 09:15:16 2012 : Debug: Waking up in 4.9 seconds. Thu Feb 2 09:15:21 2012 : Info: Cleaning up request 0 ID 138 with timestamp +16 Thu Feb 2 09:15:21 2012 : Info: Ready to process requests. I use freeradius 2.1.8 , here is a part of my site-enabled/default file (modified) : ....... authorize { files checkval expiration logintime } authenticate { # nothing!! I know... but in fact I don't know what I can write } ............ Can somebody help me? Thanks for all. -- View this message in context: http://freeradius.1045715.n5.nabble.com/MAC-auth-with-checkval-No-authentic… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 1

Doubt about Dropping Conflicting Error.
by Rodrigo Yoshioka 02 Feb '12

02 Feb '12

Hi folks, Does anyone have explanations about this error?? I couldn´t find something understandable about it on the internet. Error: Dropping conflicting packet from client PPPoE_FTTH:41882 - ID: 66 due to unfinished request 457370 My radius server gives me this error frequently. Thanks

2 1

Re[2]: bin/164526: kill(1) can not kill process despite on -KILL
by Коньков Евгений 02 Feb '12

02 Feb '12

Здравствуйте, Jilles. Вы писали 28 января 2012 г., 20:24:07: >> [stuck process cannot be killed, system hangs when reboot is >> attempted] JT> A signal cannot forcibly kill a process that is stuck in the kernel. JT> Allowing this would put the integrity of the kernel data structures at JT> risk and likely cause hangs, data corruption or panics later on. JT> If a process is stuck in the kernel for a long time, this can be things JT> like broken hardware, a non-responsive NFS server or a bug. JT> A state 'T' (stopped) probably means the process is multi-threaded and JT> is trying to suspend but one or more threads will not cooperate JT> (non-interruptible sleep or running in the kernel). JT> Useful commands to obtain more information (supposing pid is 45471): JT> ps Hl45471 JT> procstat -k 45471 JT> Of course, this does not help if you already rebooted. repeated again: bug is repeateable: 1. radiusd + mod_perl + example.pl(it is connects to FireBird) + FireBIrd 2. restart firebird 3. try to restart radiusd 4. process in fall into STOP state # ps awx | grep radi 9438 ?? TLs 5:10.12 /usr/local/sbin/radiusd 27603 2 S+ 0:00.00 grep radi # procstat -k 9438 PID TID COMM TDNAME KSTACK 9438 100080 radiusd - mi_switch sleepq_switch sleepq_wait _sx_xlock_hard _sx_xlock _vm_map_lock_upgrade vm_map_lookup vm_fault_hold vm_fault trap_pfault trap calltrap 9438 100195 radiusd - mi_switch sleepq_switch sleepq_wait __lockmgr_args ffs_lock VOP_LOCK1_APV _vn_lock vm_object_deallocate unlock_and_deallocate vm_fault_hold vm_fault trap_pfault trap calltrap 9438 101144 radiusd - mi_switch thread_suspend_switch thread_single exit1 sigexit postsig ast doreti_ast # ps wHl9438 UID PID PPID CPU PRI NI VSZ RSS MWCHAN STAT TT TIME COMMAND 133 9438 1 0 20 0 351124 322000 user m TLs ?? 0:03.65 /usr/local/sbin/radiusd 133 9438 1 0 20 0 351124 322000 ufs TLs ?? 0:00.00 /usr/local/sbin/radiusd 133 9438 1 0 20 0 351124 322000 - TLs ?? 0:05.28 /usr/local/sbin/radiusd #top last pid: 28497; load averages: 0.56, 2.34, 9.37 up 0+10:23:14 00:12:5 162 processes: 1 running, 158 sleeping, 3 stopped CPU: 1.9% user, 0.0% nice, 1.9% system, 5.3% interrupt, 90.8% idle Mem: 525M Active, 1259M Inact, 182M Wired, 41M Cache, 112M Buf, 1890M Free Swap: 4096M Total, 4096M Free PID USERNAME THR PRI NICE SIZE RES STATE C TIME WCPU COMMAND 6893 root 1 26 0 15392K 5580K select 0 21:17 6.10% snmpd 75797 bind 7 20 0 100M 77280K kqread 2 4:27 0.00% named 5553 root 7 20 0 53544K 39832K select 1 0:19 0.00% mpd5 77411 dhcpd 1 20 0 15032K 5360K select 3 0:18 0.00% dhcpd 3605 root 1 20 0 10460K 4004K select 3 0:11 0.00% zebra 5316 root 1 20 0 9616K 1244K select 1 0:10 0.00% syslogd 9438 freeradius 3 20 0 343M 314M STOP 0 0:09 0.00% radiusd 80843 mysql 26 20 0 402M 333M sbwait 0 0:05 0.00% mysqld 3611 root 1 20 0 14660K 5348K select 2 0:05 0.00% bgpd 80396 www 1 20 0 37908K 22876K lockf 1 0:01 0.00% httpd 26278 root 1 20 0 33812K 15608K select 2 0:01 0.00% httpd 10559 www 1 20 0 42004K 26768K lockf 1 0:01 0.00% httpd if I can supply another usefull debug info, answer as fast as you can, I can not wait too long. Thank you. -- С уважением, Коньков mailto:kes-kes@yandex.ru

2 1

Re: Re[2]: bin/164526: kill(1) can not kill process despite on -KILL
by Alan Buxey 01 Feb '12

01 Feb '12

kill -9 doesn't want to play either? Read the docs/debugging file. Compile FR with debugging/developer stuff and run it under gdbm control and do your killing of firebird again. It's likely to be the PERL integration as thats what will get done in when firebird is restarted. Are you perl with threading? Not sure why your going through hoops for firebird access, I'm sure there's a native module.... alan

2 1

Verifying you are Joining the Active Directory Domain
by Gilmour, Scott 01 Feb '12

01 Feb '12

Hi, Still can't figure out why the clock is skewed since both my Ubuntu and Active Directory server are showing the same time and Date. My Ubuntu server is an NTP Server but when I issue the command net time system I get this error Can't contact server (null). Error NT_STATUS_BAD_NETWORK_NAME It looks like it joined the domain but when I do a wbinfo -u it gives me an error message: Error looking up domain users. Plus when I go to my 2008 Server and I open up Active Directory, Select my Domain and choose Domain Controllers that my FreeRadius Server isn't listed in that directory but it is listed under computers. Is this correct? Thanks Scott root@FreeRadius:/home/sqauser# net ads join -U Administrator Enter Administrator's password: Using short domain name -- SQA Joined 'FREERADIUS' to realm 'SQA.net' [2012/01/31 15:44:15, 0] libads/kerberos.c:333(ads_kinit_password) kerberos_kinit_password FREERADIUS$(a)SQA.NET failed: Clock skew too great root@FreeRadius:/home/sqauser# root@FreeRadius:/home/sqauser# wbinfo -u Error looking up domain users root@FreeRadius:/home/sqauser#

4 3

Re: Member of Group Check Else REJECT
by Alan Buxey 01 Feb '12

01 Feb '12

Your unlang is wrong. If both checks are true then you will reject...anything else, ie not a member of that group or from that NAS will continue alan

1 0

Member of Group Check Else REJECT
by Neville Collins 01 Feb '12

01 Feb '12

Hi, I'm trying to check if a user coming from a particular NAS, then check in that user is also a member of a GROUP associated to that NAS, else REJECT access. Authorise section.. if(NAS-Identifier == 'OpenVPN' && SQL-GROUP == 'openvpn') { update reply { Reply-Message := "OpenVPN AuthCheck OK" } reject } Wed Feb 1 00:37:59 2012 : Info: ++? if (NAS-Identifier == 'OpenVPN' && SQL-GROUP == 'openvpn') Wed Feb 1 00:37:59 2012 : Info: ? Evaluating (NAS-Identifier == 'OpenVPN' ) -> TRUE Wed Feb 1 00:37:59 2012 : Info: sql_groupcmp Wed Feb 1 00:37:59 2012 : Info: expand: %{User-Name} -> nev Wed Feb 1 00:37:59 2012 : Info: sql_set_user escaped user --> 'nev' Wed Feb 1 00:37:59 2012 : Debug: rlm_sql (sql): Reserving sql socket id: 1 Wed Feb 1 00:37:59 2012 : Info: expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'nev' ORDER BY priority Wed Feb 1 00:37:59 2012 : Debug: rlm_sql (sql): Released sql socket id: 1 Wed Feb 1 00:37:59 2012 : Info: sql_groupcmp finished: User is NOT a member of group openvpn As user 'nev' is not part of group 'openvpn' but is trying to access NAS 'OpenVPN' it should Reject the login and not go any further, but it does not. I know I'm missing something, so any help would be greatly appreciated. Thx Nev

1 0

Re: Joining Active Directory Domain
by Alan Buxey 31 Jan '12

31 Jan '12

You do have a SRV record in your DNS pointing to required _kerberos._tcp.$domain (usually don't need to have krb5.conf configured because if this). If not, you should be able to choose the DC IP address on the net add join command line. ..giving IT infrastructure advice from corner of pub. The internet has a lot to answer for! ;) alan -- This smartphone has free worldwide WiFi access using eduroam. Now. that IS smart.

1 0

Joining Active Directory Domain
by Gilmour, Scott 31 Jan '12

31 Jan '12

> Hi, > > I am following the FreeRadius Beginners Guide book on how to > > join a domain. I keep on getting this error when running the command. > > root@FreeRadius:/etc# net ads join -U Administrator > > Enter Administrator's password: > > Using short domain name -- SQA > > Joined 'FREERADIUS' to realm 'SQA.net' > > [2012/01/31 10:21:29, 0] libads/kerberos.c:333(ads_kinit_password) > > kerberos_kinit_password FREERADIUS$(a)SQA.NET failed: Clock skew too great > > No DNS domain configured for freeradius. Unable to perform DNS Update. > > DNS update failed! This is Samba being annoying. The "net ads" stuff "cares" about your hostname, i.e. $ hostname freeradius ...won't work. You can fool it by temporarily changing your domain to: $ hostname freeradius.soa.net Hi, I am assuming I should edit the $ hostname freeradius.sqa.net in the /etc/hostname file? The only config file I don't have is the krbd5 config file but it ays it is not necessary in the www.deployingradius.com website. You may also have to edit the /etc/krb5.conf file, to add an entry that points to the Active Directory Server. This is often not necessary, as Samba can just "figure it out" when Active Directory is also the main DNS server. I am unable to installthe krdb5-kdc file using the synaptic package manager. Still getting this error: root@FreeRadius:/home/sqauser# net join -U Administrator Enter Administrator's password: Failed to join domain: failed to find DC for domain SQA.NET ADS join did not work, falling back to RPC... Unable to find a suitable server for domain SQA Unable to find a suitable server for domain SQA root@FreeRadius:/home/sqauser# Thanks for everyones feedback. I will continue to debug my issue. Scott

1 0

Re: Joining Active Directory Domain
by Alan Buxey 31 Jan '12

31 Jan '12

And your system time is too far from that of the AD. Ensure you are sync'd eg with ntpdate or ntpd alan

1 0