- Freeradius-Users - lists.freeradius.org

update/replace reply
by Wayne Lee 25 Oct '10

25 Oct '10

Hello List Hopefully somebody will point me in the right direction. I posted a message last week about my confusion with unlang, Alan correctly pointed out some of the mistakes I was making and I was able to fix them but I've hit another issue. What is the best way to do the following ? If calling-station-id and group match send below (request from provider) Tunnel-Type = "L2TP", Tunnel-Medium-Type = "IP", Tunnel-Server-Endpoint := "192.168.0.1", Cisco-AVPair := "vpdn:tunnel-id=provider.net", Cisco-AVPair := "vpdn:l2tp-tunnel-password=abc", If calling-station-id missing but group matches send below (request from my LNS's) Framed-IP-Address Framed-IP-Netmask Cisco-AVPair 1 Cisco-AVPair 2 All the reply info is mixed within the group-reply and user-reply. Do I use different tables or a mixture of files and sql if so how do I set which to use depending on the requestor ? I have read the man pages, archive and google plus ran in debug mode but I just don't understand how to use separate files/tables per requestor to do this part. Version = 2.1.10+dfsg-1~bpo50+1 on Debian Thanks Wayne

1 0

are there any characters not allowed in a password used with LDAP "bind as user"?
by mark.leese＠stfc.ac.uk 25 Oct '10

25 Oct '10

Hi, For a couple of years I've been successfully using FreeRADIUS to authenticate some users against Active Directory using cleartext passwords, a Perl script to do some department checking, and a simple LDAP "bind as user". I've now got at least one user who fails authentication, and I'm wondering if the problem is a backslash in their password. The password is... w[)xg=\7k2 I can use the same username and password to successfully LDAP bind to AD using a tool like ldapsearch from my Linux based RADIUS server, but using RADIUS itself fails. If it helps here's the -X debug trace: Wed Oct 20 15:36:19 2010 : Debug: Ready to process requests. rad_recv: Access-Request packet from host 172.16.80.3 port 20002, id=9, length=135 User-Name = "bill" Calling-Station-Id = "00-24-D7-40-8C-8C" Called-Station-Id = "00-0B-0E-DE-AB-80" NAS-Port = 52340 NAS-Port-Type = Wireless-802.11 NAS-IP-Address = 172.16.80.3 User-Password = "w[)xg=\\7k2" Wed Oct 20 15:39:10 2010 : Info: +- entering group authorize {...} Wed Oct 20 15:39:10 2010 : Info: ++[preprocess] returns ok Wed Oct 20 15:39:10 2010 : Info: [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/172.16.80.3/auth-detail-20101020 Wed Oct 20 15:39:10 2010 : Info: [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/172.16.80.3/auth-detail-20101020 Wed Oct 20 15:39:10 2010 : Info: [auth_log] expand: %t -> Wed Oct 20 15:39:10 2010 Wed Oct 20 15:39:10 2010 : Info: ++[auth_log] returns ok Wed Oct 20 15:39:10 2010 : Info: [ldap] performing user authorization for bill Wed Oct 20 15:39:10 2010 : Info: [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details Wed Oct 20 15:39:10 2010 : Info: [ldap] expand: (sAMAccountName=%{Stripped-User-Name:-%{User-Name}}) -> (sAMAccountName=bill) Wed Oct 20 15:39:10 2010 : Info: [ldap] expand: dc=fed,dc=foo,dc=ac,dc=uk -> dc=fed,dc=foo,dc=ac,dc=uk Wed Oct 20 15:39:10 2010 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Wed Oct 20 15:39:10 2010 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Wed Oct 20 15:39:10 2010 : Debug: rlm_ldap: attempting LDAP reconnection Wed Oct 20 15:39:10 2010 : Debug: rlm_ldap: (re)connect to logonserv.fed.foo.ac.uk:389, authentication 0 Wed Oct 20 15:39:10 2010 : Debug: rlm_ldap: bind as / to logonserv.fed.foo.ac.uk:389 Wed Oct 20 15:39:10 2010 : Debug: rlm_ldap: waiting for bind result ... Wed Oct 20 15:39:10 2010 : Debug: rlm_ldap: Bind was successful Wed Oct 20 15:39:10 2010 : Debug: rlm_ldap: performing search in dc=fed,dc=foo,dc=ac,dc=uk, with filter (sAMAccountName=bill) Wed Oct 20 15:39:10 2010 : Info: [ldap] looking for check items in directory... Wed Oct 20 15:39:10 2010 : Info: [ldap] looking for reply items in directory... Wed Oct 20 15:39:10 2010 : Debug: WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? Wed Oct 20 15:39:10 2010 : Info: [ldap] Setting Auth-Type = LDAP Wed Oct 20 15:39:10 2010 : Info: [ldap] user bill authorized to use remote access Wed Oct 20 15:39:10 2010 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Wed Oct 20 15:39:10 2010 : Info: ++[ldap] returns ok Wed Oct 20 15:39:10 2010 : Info: ++[expiration] returns noop Wed Oct 20 15:39:10 2010 : Info: ++[logintime] returns noop Wed Oct 20 15:39:10 2010 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Wed Oct 20 15:39:10 2010 : Info: ++[pap] returns noop Wed Oct 20 15:39:10 2010 : Info: ++? if (control:Auth-Type == LDAP) Wed Oct 20 15:39:10 2010 : Info: ? Evaluating (control:Auth-Type == LDAP) -> TRUE Wed Oct 20 15:39:10 2010 : Info: ++? if (control:Auth-Type == LDAP) -> TRUE Wed Oct 20 15:39:10 2010 : Info: ++- entering if (control:Auth-Type == LDAP) {...} Wed Oct 20 15:39:10 2010 : Debug: rlm_perl: Added pair NAS-Port-Type = Wireless-802.11 Wed Oct 20 15:39:10 2010 : Debug: rlm_perl: Added pair Called-Station-Id = 00-0B-0E-DE-AB-80 Wed Oct 20 15:39:10 2010 : Debug: rlm_perl: Added pair Calling-Station-Id = 00-24-D7-40-8C-8C Wed Oct 20 15:39:10 2010 : Debug: rlm_perl: Added pair User-Name = bill Wed Oct 20 15:39:10 2010 : Debug: rlm_perl: Added pair NAS-Identifier = Trapeze Wed Oct 20 15:39:10 2010 : Debug: rlm_perl: Added pair User-Password = w[)xg=\\7k2 Wed Oct 20 15:39:10 2010 : Debug: rlm_perl: Added pair NAS-Port = 52340 Wed Oct 20 15:39:10 2010 : Debug: rlm_perl: Added pair NAS-IP-Address = 172.16.80.3 Wed Oct 20 15:39:10 2010 : Debug: rlm_perl: Added pair Auth-Type = LDAP Wed Oct 20 15:39:10 2010 : Debug: rlm_perl: Added pair Ldap-UserDn = CN=bill,OU=Facility Users,OU=FBU,DC=fed,DC=foo,DC=ac,DC=uk Wed Oct 20 15:39:10 2010 : Info: +++[perl] returns noop Wed Oct 20 15:39:10 2010 : Info: ++- if (control:Auth-Type == LDAP) returns noop Wed Oct 20 15:39:10 2010 : Info: Found Auth-Type = LDAP Wed Oct 20 15:39:10 2010 : Info: +- entering group LDAP {...} Wed Oct 20 15:39:10 2010 : Info: [ldap] login attempt by "bill" with password "w[)xg=\\7k2" Wed Oct 20 15:39:10 2010 : Info: [ldap] user DN: CN=bill,OU=Facility Users,OU=FBU,DC=fed,DC=foo,DC=ac,DC=uk Wed Oct 20 15:39:10 2010 : Debug: rlm_ldap: (re)connect to logonserv.fed.foo.ac.uk:389, authentication 1 Wed Oct 20 15:39:10 2010 : Debug: rlm_ldap: bind as CN=bill,OU=Facility Users,OU=FBU,DC=fed,DC=foo,DC=ac,DC=uk/w[)xg=\\7k2 to logonserv.fed.foo.ac.uk:389 Wed Oct 20 15:39:10 2010 : Debug: rlm_ldap: waiting for bind result ... Wed Oct 20 15:39:10 2010 : Debug: rlm_ldap: Bind failed with invalid credentials Wed Oct 20 15:39:10 2010 : Info: ++[ldap] returns reject Wed Oct 20 15:39:10 2010 : Info: Failed to authenticate the user. Wed Oct 20 15:39:10 2010 : Auth: Login incorrect (rlm_ldap: Bind as user failed): [bill] (from client wireless-2 port 52340 cli 00-24-D7-40-8C-8C) Wed Oct 20 15:39:10 2010 : Info: Using Post-Auth-Type Reject I don't know whether the problem lies with me (for allowing a backslash in the password in the first place) the NAS for appearing to 'escape' the backslash (with a backslash) or the way I've configured FreeRADIUS. Can anyone give me any pointers? Thanks in advance of any advice, Cheers, Mark. -- Scanned by iCritical.

2 3

plpgsql freeradius authentication function
by Kafui Akyea 25 Oct '10

25 Oct '10

Hi I have a plpgsql function being called from freeradius to do authentication but i keep getting Access-Reject from radius although when i run the function without freeradius it works fine. Please find below the function and how i call it CREATE OR REPLACE FUNCTION try (your_name TEXT, tiger TEXT) RETURNS RECORD AS $$ DECLARE users_rec RECORD; BEGIN if tiger = '0000' then SELECT INTO users_rec * FROM aniradcheck WHERE username = your_name; else SELECT INTO users_rec * FROM radcheck WHERE username = your_name; end if; RETURN users_rec.username; END; $$ LANGUAGE plpgsql; SELECT id,username,attribute,op,value FROM try('7140944444','0000') as(id integer,username varchar,attribute varchar,op character,value varchar); Appreciate if you can help Thanks

4 11

Problems -- rad_verify: invalid signature (err=2)！（shared secret is incorrect）
by Xiaochen 25 Oct '10

25 Oct '10

Hi all, I am using Fedora 12 and Freeradius 1.2.9 to do some COA test. When AAA sends Disconnect-request to my AGW, the AGW reply with a Disconnect-ACK, and my MS disconnects. But the rad_verify says: ----------------------------------------------------------------------- Received Disconnect-ACK packet from clinet 100.1.6.4 port 3799 with invalid signature (err=2)! (shared secret is incorrect. ----------------------------------------------------------------------- In fact the shared secret is correct!!! My disconnect packt.txt is like: ----------------------------------------------------------------------- Acct-Session-Id="00000001" Calling-Station-Id="001E310008CC" User-Name="wimax(a)zte.com" X-Ascend-Session-Svr-Key="0123456789" NAS-IP-Address=100.1.6.4 NAS-Identifier=CATR WiMAX-DM-Action-Code="0xffff" WiMAX-AAA-Session-Id="00000002" ----------------------------------------------------------------------- I don’t know how to solve this problem, can you please give any suggestions? Thanks a lot! Xiaochen @ a WiMAX Lab

3 2

FR 2.1.11git, Dead home server status server reply - possible minor bug
by James J J Hooper 25 Oct '10

25 Oct '10

Hi Alan et al, {Running FR from GIT upto commit b42665d4475835f38fe71ef749e39cd22587bcfa, Sat Oct 9 17:52} Doing: /bin/echo "Message-Authenticator = 0x00, FreeRADIUS-Statistics-Type = 131, FreeRADIUS-Stats-Server-IP-Address = ".....", FreeRADIUS-Stats-Server-Port = 1812" | /usr/local/bin/radclient localhost:18120 status secret when the homeserver is "dead" I get back: Received response ID 178, code 2, length = 200 FreeRADIUS-Stats-Server-IP-Address = ..... FreeRADIUS-Stats-Server-Port = 1812 FreeRADIUS-Stats-Server-Outstanding-Requests = 0 FreeRADIUS-Stats-Server-State = Dead FreeRADIUS-Stats-Server-Time-Of-Death = "Jan 6 1970 18:54:00 UTC" FreeRADIUS-Total-Proxy-Access-Requests = 1651 FreeRADIUS-Total-Proxy-Access-Accepts = 122 FreeRADIUS-Total-Proxy-Access-Rejects = 60 FreeRADIUS-Total-Proxy-Access-Challenges = 1345 FreeRADIUS-Total-Proxy-Auth-Responses = 1527 FreeRADIUS-Total-Proxy-Auth-Duplicate-Requests = 0 FreeRADIUS-Total-Proxy-Auth-Malformed-Requests = 0 FreeRADIUS-Total-Proxy-Auth-Invalid-Requests = 0 FreeRADIUS-Total-Proxy-Auth-Dropped-Requests = 0 FreeRADIUS-Total-Proxy-Auth-Unknown-Types = 0 The date (Time-Of-Death) seems a little odd. I poked around in the code and got as far as the below, which looks possibly wrong, but I don't understand C enough to work out what to do with it from the surrounding code: /src/main/event.c: /* * Enable the zombie period when we notice that the home * server hasn't responded for a while. We back-date the * zombie period to when we last received a response from * the home server. */ home->state = HOME_STATE_ZOMBIE; home->zombie_period_start.tv_sec = home->last_packet; home->zombie_period_start.tv_sec = USEC / 2; {Apologies if I'm totally going in the wrong direction} Regards, James -- James J J Hooper Network Specialist Information Services University of Bristol http://www.wireless.bristol.ac.uk --

2 1

RE: How to raise numbers of request/sec in Freeradius
by Robin 25 Oct '10

25 Oct '10

Hi Alan, Thanks your reply firstly. I use Mysql to authentication. When I use a PPPOE client to call FreeRADIUS one time,that’s all ok. I create 200 pppoe accounts as dialing client in Mikrotik server. When I use them to call FreeRADIUS at the same time, I find only about 5-20 successful logins by sec. I don’t know how to increase the numbers? If you have any details information, I can provide to you. Expect to your help. Thank you very much! Robin -----Original Message----- From: Alan DeKok [mailto:aland@deployingradius.com] Sent: Friday, October 22, 2010 5:18 PM To: FreeRadius users mailing list Subject: Re: How to raise numbers of request/sec in Freeradius Robin wrote: > I use the tools of Evolynx Radius Load Test to test number of request by > second. I find only max 20-25 requests/sec in Freeradius. > > > > Can I raise the number via editing configuration files? When authentication is from the "users" file, the server can do 10K requests/s. The issue isn't FreeRADIUS. It's something else. So... what are you doing with the authentication requests? Alan DeKok.

2 1

www.freeradius.org url link error
by Omer Faruk SEN 25 Oct '10

25 Oct '10

Hi, At http://freeradius.org/ for release 2.1.10 there is a clause Added RFCs 5607, 5904, and 5997. For 5607 http://ietf.org/rfc/rfc5607.txt But for others: http://ietf.org/rfc/rfc5904 and http://ietf.org/rfc/rfc5997 was used.They should be: http://ietf.org/rfc/rfc5904.txt http://ietf.org/rfc/rfc5997.txt No big deal. Just wanted to inform. Regards.

2 1

Re: freeradius proxy can't recognize Delegated-IPv6-Prefix attribute
by ichiro tanaka 25 Oct '10

25 Oct '10

thanks Alan. (i couldn't get your reply to my mailbox. so, i made a new mail. sorry...) > Fix the proxy so that it's using the dictionaries from 2.1.10. The >debug *claims* it's 2.1.10, but the Delegated-IPv6-Prefix attribute *is* >defined in the dictionaries for 2.1.10. > > Alan DeKok. My freeradius proxy already includes "dictionary.rfc4818". Do I need something? [[ radiusd -X ]] including configuration file /tmp/radius/etc/raddb/sites-enabled/default including configuration file /tmp/radius/etc/raddb/sites-enabled/inner-tunnel including dictionary file /tmp/radius/etc/raddb/dictionary main { prefix = "/tmp/radius" localstatedir = "/tmp/radius/var" [[ /tmp/radius/etc/raddb/dictionary ]] $INCLUDE /tmp/radius/share/freeradius/dictionary [[ /tmp/radius/share/freeradius/dictionary ]] $INCLUDE dictionary.rfc4679 $INCLUDE dictionary.rfc4818 ~~~~~~~~~~~~~~~~~~~~~~~~~~~ $INCLUDE dictionary.rfc4849 [[ dictionary.rfc4818 ]] ATTRIBUTE Delegated-IPv6-Prefix 123 ipv6prefix

3 5

LDAP authentication failed
by snowman5840 22 Oct '10

22 Oct '10

Hi i have some problems with LDAP authentication. If I login on my windows xp sp3 client i want to check die login credentials against my LDAP service. But the xp client uses doubleslashs in the username!! I think this will be the problem!? If I test with radtest it works. What can i do to succecsful login? Debug log: rad_recv: Access-Request packet from host 192.168.0.2 port 1812, id=62, length=240 NAS-IP-Address = 192.168.0.2 NAS-Port = 50009 NAS-Port-Type = Ethernet User-Name = "FIRMA1\\usera" Called-Station-Id = "00-15-F9-D8-7C-C9" Calling-Station-Id = "00-1A-4B-63-69-0B" Service-Type = Framed-User Framed-MTU = 1500 State = 0xc5fe953bc3f98c0b9575e677705364e2 EAP-Message = 0x0207006119001703010056b327be51594f6985d1854f17199fefe7151d57481c244787051f7067a50a0056a15e0a831a3aa3661a61aeed66e3c7dc85cd3315301bfd825c786fd60e0110f5124e76e2d543c9a6fd99371be7f1a9637b8ce527669f Message-Authenticator = 0xad6e1b5107c7af4b9a5ba3e648d65859 +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "FIRMA1\usera", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 7 length 74 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [ldap] performing user authorization for FIRMA1\usera [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> FIRMA1\5cusera [ldap] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=FIRMA1\5cusera) [ldap] expand: dc=firma1,dc=de -> dc=firma1,dc=de [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=firma1,dc=de, with filter (uid=FIRMA1\5cusera) [ldap] object not found [ldap] search failed [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns notfound Configuration part of LDAP module: ldap { server = "192.168.0.5" identity = "cn=admin,dc=firma1,dc=de" password = "xxxx" basedn = "dc=firma1,dc=de" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" ...... } -- View this message in context: http://freeradius.1045715.n5.nabble.com/LDAP-authentication-failed-tp321786… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 5

Activate LDAP group membership checking
by mic nightic 22 Oct '10

22 Oct '10

Hi, I'm trying to activate the LDAP group membership checking in FreeRadius. In my radiusd.conf i've modified the group checking section: groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" groupmembership_attribute = ou By looking in my openldap logs, freeradius is not even trying to search for the group. Do i have to activate something else to enable group checking? Thank you

2 2