- Freeradius-Users - lists.freeradius.org

Fail to restart radiusd
by Yang Xue 29 Jul '10

29 Jul '10

Hi, We're running freeradius server v2.0.3 and restart of the daemon failed with: #/etc/init.d/radiusd restart Stopping RADIUS server: [FAILED] Starting RADIUS server: Fri Jul 16 07:50:16 2010 : Info: Starting - reading configuration files ... [FAILED] In the radius.log, it shows: Error: There appears to be another RADIUS server running on the authentication port 1812 <--- The odd thing is that there is no radiusd process running on the Linux server at all: # ps aux | grep rad root 4869 0.0 0.0 4544 636 pts/1 S+ 12:11 0:00 grep rad #Debug messages: /usr/sbin/radiusd -X restart Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/" main: localstatedir = "//var" main: logdir = "/var/log" main: libdir = "//lib" main: radacctdir = "/etc/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1812 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "/var/log/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "//var/run/radiusd/radiusd.pid" main: bind_address = 10.25.210.21 IP address [10.25.210.21] main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "//sbin/checkrad" main: proxy_requests = no proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms There appears to be another RADIUS server running on the authentication port 1812 <--- Does anybody know why it complains about "another RADIUS server running on the authentication port 1812" although there is no existing radiusd process at all? Thanks.

5 16

Error: ASSERT FAILED threads.c[406]
by Meyers, Dan 28 Jul '10

28 Jul '10

Quick bit of background. We're using FreeRADIUS in combination with rlm_perl for network access control at our site. Everything was running fine on FreeBSD 8.0 with FreeRADIUS 2.1.8 compiled from ports and Perl 5.8 compiled to be non-threaded and not support multiplicity. We got new higher spec servers from Dell, and sadly the only *nix OS that currently supports the RAID card in them seems to be Ubuntu Server 10.4, so we're now on that. Perl is compiled (as it is by default on Ubuntu) with threads and multiplicity, but some testing by hammering the server from multiple different machines using radclient and some test packets from a file seemed to show that (unlike the last time we tried, which I believe was on FreeRADIUS 2.1.3) using threaded perl was stable and worked fine with rlm_perl in FreeRADIUS (it used to lock up eventually). Ran fine for a week or so, but in the last few days we've had it crash twice, both times with the same message. The logs initially fill with messages of the sort: "Sat Jul 24 01:05:08 2010 : Error: WARNING: Unresponsive child for request 128145, in module perl component accounting" and "Sat Jul 24 01:05:08 2010 : Info: WARNING: Child is hung for request 128145." We'll end up with 32 of the former type of error message (we're currently running with 32 threads configured in the thread_pool in radius.conf), interspersed with the latter, then a stack of the latter type of error (Always for the same set of requests, i.e. one of the ones we got an initial error for, but we'll get the second error multiple times for a given request). Then eventually we get "Sat Jul 24 01:05:27 2010 : Error: ASSERT FAILED threads.c[406]: (*request)->magic == REQUEST_MAGIC" All our accounting module does in perl is convert the incoming radius hash to yaml and then attempt to write it to a database with a timestamp. I am strongly suspecting that the initial problem is to do with threading in combination with the DBD::MySQL module in perl or the MySQL client rather than FreeRADIUS, despite our testing seeming to show it was OK. But I do not think that final ASSERT FAILED error should be being generated as a result of the former issue. I am trying to understand what is going on. Is FreeRADIUS attempting to kill the deadlocked threads and being unable to do so? Thanks Dan

3 4

incorrect auth-type
by Sallee, Stephen (Jake) 28 Jul '10

28 Jul '10

I am new to FreeRADIUS so please be patient with me. I am scouring the docs as I write this but so far I have been stumped. Below I have included the debug output of my server when I send it a authentication request. You will see that the user is found and authenticated by the "ntlm_auth_Cru" module, however the user is still rejected bec the server says no auth-type was configured for the request. Any help is appreciated. I have the following lines in my users file: ----------------- DEFAULT Auth-Type := ntlm_auth Fall-Through = Yes ----------------- I also have the following in my radius.conf: ------------------ redundant ntlm_auth { group { ntlm_auth_Cru { reject = 1 ok = return } ntlm_auth_UMHB { reject = 1 ok = return } } } ------------------ Here is the debug output: ------------------ rad_recv: Access-Request packet from host 10.2.1.75 port 46841, id=239, length=51 User-Name = "image" User-Password = "image" NAS-IP-Address = 10.2.1.75 Tue Jul 27 13:01:03 2010 : Info: +- entering group authorize {...} Tue Jul 27 13:01:03 2010 : Info: ++[preprocess] returns ok Tue Jul 27 13:01:03 2010 : Info: ++- entering group ntlm_auth {...} Tue Jul 27 13:01:03 2010 : Info: +++- entering group {...} Tue Jul 27 13:01:03 2010 : Info: [ntlm_auth_Cru] expand: --username=%{mschap:User-Name} -> --username=image Tue Jul 27 13:01:03 2010 : Info: [ntlm_auth_Cru] expand: --password=%{User-Password} -> --password=image Tue Jul 27 13:01:03 2010 : Debug: Exec-Program output: NT_STATUS_OK: Success (0x0) Tue Jul 27 13:01:03 2010 : Debug: Exec-Program-Wait: plaintext: NT_STATUS_OK: Success (0x0) Tue Jul 27 13:01:03 2010 : Debug: Exec-Program: returned: 0 Tue Jul 27 13:01:03 2010 : Info: ++++[ntlm_auth_Cru] returns ok Tue Jul 27 13:01:03 2010 : Info: +++- group returns ok Tue Jul 27 13:01:03 2010 : Info: ++- group ntlm_auth returns ok Tue Jul 27 13:01:03 2010 : Info: ++[expiration] returns noop Tue Jul 27 13:01:03 2010 : Info: ++[logintime] returns noop GOT CLONE -1208792368 0x9f8ff70 Tue Jul 27 13:01:03 2010 : Debug: rlm_perl: PacketFence SWITCH: 10.2.1.75 Tue Jul 27 13:01:03 2010 : Debug: rlm_perl: PacketFence MAC: Tue Jul 27 13:01:03 2010 : Debug: rlm_perl: PacketFence USER: image Tue Jul 27 13:01:03 2010 : Debug: rlm_perl: Added pair User-Name = image Tue Jul 27 13:01:03 2010 : Debug: rlm_perl: Added pair User-Password = image Tue Jul 27 13:01:03 2010 : Debug: rlm_perl: Added pair NAS-IP-Address = 10.2.1.75 Tue Jul 27 13:01:03 2010 : Info: ++[perl] returns ok Tue Jul 27 13:01:03 2010 : Info: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Tue Jul 27 13:01:03 2010 : Info: Failed to authenticate the user. Tue Jul 27 13:01:03 2010 : Info: Using Post-Auth-Type Reject Tue Jul 27 13:01:03 2010 : Info: +- entering group REJECT {...} Tue Jul 27 13:01:03 2010 : Info: [attr_filter.access_reject] expand: %{User-Name} -> image Tue Jul 27 13:01:03 2010 : Debug: attr_filter: Matched entry DEFAULT at line 11 Tue Jul 27 13:01:03 2010 : Info: ++[attr_filter.access_reject] returns updated Tue Jul 27 13:01:03 2010 : Info: Delaying reject of request 0 for 1 seconds Tue Jul 27 13:01:03 2010 : Debug: Going to the next request Tue Jul 27 13:01:03 2010 : Debug: Waking up in 0.8 seconds. Tue Jul 27 13:01:04 2010 : Info: Sending delayed reject for request 0 Sending Access-Reject of id 239 to 10.2.1.75 port 46841 Tue Jul 27 13:01:04 2010 : Debug: Waking up in 4.9 seconds. Tue Jul 27 13:01:09 2010 : Info: Cleaning up request 0 ID 239 with timestamp +26 Tue Jul 27 13:01:09 2010 : Debug: Ready to process requests. ------------------ PS: I know it is not best practice to specify the default auth-type but this is a single purpose server and I know what types of requests are going to come to it, anything other than what I want should be discarded. Jake Sallee Godfather Of Bandwidth Network Engineer Fone: 254-295-4658 Phax: 254-295-4221

2 1

Re: Freeradius-Users Digest, Vol 63, Issue 97
by ping 28 Jul '10

28 Jul '10

I constently get this error: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user why? On 07/28/2010 08:07 AM, freeradius-users-request(a)lists.freeradius.org wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: SV: FR proxy to ACS and NPS with MS CHAP v2 (SagiBarOr) > 2. RHDS (Natr Brazell) > 3. RE: Bug #17 (MS-CHAP user names) (Garber, Neal) > 4. incorrect auth-type (Sallee, Stephen (Jake)) > 5. Re: RHDS (John Dennis) > 6. coa proxy'ing with a NAC device (Kevin Ehlers) > 7. Passing variables from inner tunnel (newtownz) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 27 Jul 2010 04:12:16 -0700 (PDT) > From: SagiBarOr<sagi.bar-or(a)intel.com> > Subject: Re: SV: FR proxy to ACS and NPS with MS CHAP v2 > To: freeradius-users(a)lists.freeradius.org > Message-ID:<29275298.post(a)talk.nabble.com> > Content-Type: text/plain; charset=UTF-8 > > > Thank you for the info Jan. The radiusd-x files were included in the zip > files. Though I guess the other logs were overwhelming. > I now posted the two log files here. > The file cn-check_splitauth.log is from the first free radius. > The file ldap_mschapv2.log is from the second FR server which does the MS > CHAP v2 portion. > Note that everything works in this confioguration. No issues. What I like > the forum to advise, is what might be non std or missing in the MC CHAP v2 > session, which FR overcomes it. > When I replace the 2nd FR with MS NPS or Cisco NPS the authentication fails, > looks like because the pwd (hash) does not match. > Thnks > Sagi > > > > Madsen.Jan JMD wrote: > >> I think you need to stop the radius process and then start i with radiusd >> -X >> This will run freeradius in the window you are starting it in, in debug >> mode. >> >> On a Linux it will look something like this >> /usr/sbin/freeradius -X (Default Debian install directory) >> >> Or in a manually compiled >> /opt/freeradius-1.1.8/sbin/radiusd -X (My install location) >> >> And that output it comes from that is what Phil wants :) >> >> Best regards >> Jan Madsen >> >> >> >> -----Oprindelig meddelelse----- >> Fra: freeradius-users-bounces+jmd=kmd.dk(a)lists.freeradius.org >> [mailto:freeradius-users-bounces+jmd=kmd.dk@lists.freeradius.org] P? vegne >> af SagiBarOr >> Sendt: 15. juli 2010 09:46 >> Til: freeradius-users(a)lists.freeradius.org >> Emne: Re: FR proxy to ACS and NPS with MS CHAP v2 >> >> >> Thank you for the clarification Phil. I am not sure what "radius -x" >> means. I >> posted the two output files I have. Are these the ones? If not, pls >> elaborate. >> >> Note that these are the output files for the two FR servers, for which >> eveything is just fine. What does not work is when the second server is >> not >> FR but NPS or ACS. I hope this data will suffice to identify the issue or >> at least give good leads. >> >> >> >> >> >> Phil Mayers wrote: >> >>> On 07/14/2010 11:17 PM, SagiBarOr wrote: >>> >>>> Files posted. >>>> >>> No. >>> >>> Post the output of "radiusd -X" to the list. >>> >>> We don't need anything else; just that. >>> - >>> List info/subscribe/unsubscribe? See >>> http://www.freeradius.org/list/users.html >>> >>> >>> >> http://old.nabble.com/file/p29170161/cn-check_splitauth.log >> cn-check_splitauth.log >> http://old.nabble.com/file/p29170161/ldap_mschapv2.log ldap_mschapv2.log >> -- >> View this message in context: >> http://old.nabble.com/FR-proxy-to-ACS-and-NPS-with-MS-CHAP-v2-tp29132664p29… >> Sent from the FreeRadius - User mailing list archive at Nabble.com. >> >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html >> __________________________________________________________________________________________ >> KMD A/S, Lautrupparken 40-42, DK-2750 Ballerup, CVR-nr. 26911745 >> >> KMD er medlem af IT-Branchen og Dansk Erhverv samt anmeldt til >> Datatilsynet som edb-servicevirksomhed. KMD er certificeret i henhold til >> ISO 9001:2000, med Dansk Standard som certificerende organ og er desuden >> Microsoft Gold Certified Partner og Certificeret SAP Hosting Center. >> >> www.kmd.dk www.kundenet.kmd.dk www.organisator.dk >> www.kmdinternational.com >> >> Hvis du har modtaget denne e-mail ved en fejl, bedes du venligst give mig >> besked herom og slette den. >> If you received this e-mail by mistake, please notify me and delete it. >> Thank you. >> __________________________________________________________________________________________ >> KMD A/S, Lautrupparken 40-42, DK-2750 Ballerup, CVR-nr. 26911745 >> >> KMD er medlem af IT-Branchen og Dansk Erhverv samt anmeldt til >> Datatilsynet som edb-servicevirksomhed. KMD er certificeret i henhold til >> ISO 9001:2000, med Dansk Standard som certificerende organ og er desuden >> Microsoft Gold Certified Partner og Certificeret SAP Hosting Center. >> >> www.kmd.dk www.kundenet.kmd.dk www.organisator.dk >> www.kmdinternational.com >> >> Hvis du har modtaget denne e-mail ved en fejl, bedes du venligst give mig >> besked herom og slette den. >> If you received this e-mail by mistake, please notify me and delete it. >> Thank you. >> >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html >> >> >> > http://old.nabble.com/file/p29275298/cn-check_splitauth.log > cn-check_splitauth.log > http://old.nabble.com/file/p29275298/ldap_mschapv2.log ldap_mschapv2.log > -- > View this message in context: http://old.nabble.com/FR-proxy-to-ACS-and-NPS-with-MS-CHAP-v2-tp29132664p29… > Sent from the FreeRadius - User mailing list archive at Nabble.com. > > > > > ------------------------------ > > Message: 2 > Date: Tue, 27 Jul 2010 12:59:43 -0400 > From: Natr Brazell<natrbrazell(a)gmail.com> > Subject: RHDS > To: freeradius-users(a)lists.freeradius.org > Message-ID: > <AANLkTimumkhagDih-xi4FhfXQybKgcPsNkxaTeMmHtWp(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > Anyone using the Redhat Directory Server (RHDS) or 389-server versions of > LDAP with their freeradius services? Curious really? > > Thanks, > Nate Brazell >

2 1

/etc/freeradius/radiusd.conf[236]: Error binding to port for 0.0.0.0 port 1812
by Edi Sujono 28 Jul '10

28 Jul '10

Dear sir, I had installed freeradius on ubuntu 9.04, but got an error when applying the command : freeradius -X the result of freeradius -X command as per attachement file. Your attention and help would be highly appreciated. Thanks & best regards, Edi Sujono

2 2

RHDS
by Natr Brazell 27 Jul '10

27 Jul '10

Anyone using the Redhat Directory Server (RHDS) or 389-server versions of LDAP with their freeradius services? Curious really? Thanks, Nate Brazell

2 1

Bug #17 (MS-CHAP user names)
by Alan DeKok 27 Jul '10

27 Jul '10

I've had a chance to look at the final set of patches for bug #17. This is the bug where the supplicant sends "Name" for EAP-Identity, but uses "name" for the EAP-MSCHAPv2 calculations. I've done some minor editing to the patches, and put them into the code for 2.1.10. Thanks to Neal Garber for the report, the patch, and the patience. Alan DeKok.

2 1

Re: Reg: Accounting RequestAuthenticator Secret
by Karthikeyan Gopal - ERS, HCL Tech 27 Jul '10

27 Jul '10

Hi Alan, In my actual deployment I have Radius client, RADIUS proxy and RADIUS Server. Accounting-Request is originated form Radius client after success-full authentication. Accounting request authenticator is generated using RADIUS proxy secret in RADIUS client. RADIUS proxy functionality is to forward Accounting request to Remote Accounting server. While doing proxy functionality Accounting-Request authenticator is re-calculated using Remote Accounting server secret and updates he request with re-calculated value and the request is posted to remote end. Please tell me whether my understanding about Accounting-Request authenticator and secret is correct. Regards, Karthik ________________________________ Karthikeyan Gopal - ERS, HCL Tech wrote: > *My config:* > *NAS shared secret = testing123* > *Accounting server Secret = 123testing* The NAS is sending accounting packets, too. There is no "NAS" secret and "accounting" secret. There may be different secrets for authentication and accounting, but the NAS will send both packets. Alan DeKok. ________________________________ * To: "freeradius-users(a)lists.freeradius.org<mailto:freeradius-users%40lists.freeradius.org>" <freeradius-users(a)lists.freeradius.org<mailto:freeradius-users%40lists.freeradius.org>> * Subject: Reg: Accounting RequestAuthenticator Secret * From: "Karthikeyan Gopal - ERS, HCL Tech" <g_karthikeyan(a)hcl.in<mailto:g_karthikeyan%40hcl.in>> * Date: Mon, 26 Jul 2010 20:50:47 +0530 * Accept-language: en-US * Acceptlanguage: en-US * Reply-to: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org<mailto:freeradius-users%40lists.freeradius.org>> * Thread-index: Acss1h+3WmRLIuT+TCu3f/mEc2d7qw== * Thread-topic: Reg: Accounting RequestAuthenticator Secret size=2 width="100%" align=center> Hi, I have one basic question in generating Accounting-Request and Response Authenticator generation. My config: NAS shared secret = testing123 Accounting server Secret = 123testing While generating Accounting-Request Authenticator which secret to use? NAS or Acct server secret? In Accounting Response: Which secret should be used to generate accounting response authenticator? Regards, Karthik DISCLAIMER: ----------------------------------------------------------------------------------------------------------------------- The contents of this e-mail and any attachment(s) are confidential and intended for the named recipient(s) only. It shall not attach any liability on the originator or HCL or its affiliates. Any views or opinions presented in this email are solely those of the author and may not necessarily reflect the opinions of HCL or its affiliates. Any form of reproduction, dissemination, copying, disclosure, modification, distribution and / or publication of this message without the prior written consent of the author of this e-mail is strictly prohibited. If you have received this email in error please delete it and notify the sender immediately. Before opening any mail and attachments please check them for viruses and defect. -----------------------------------------------------------------------------------------------------------------------

2 1

Query regarding sending the data in Radius Message
by Vijay Badola 27 Jul '10

27 Jul '10

Hi, I want to know that, can we send 'long long' (byte size 8) and 'double log'( byte size is 12) type Variable in Radius message using freeradius APIs. If yes how???? ,Regards Vijay Badola * P We have responsibility to the environment. Before printing this e-mail or any other document, let's ask ourselves whether we need a hard copy.

2 1

Reg: Accounting RequestAuthenticator Secret
by Karthikeyan Gopal - ERS, HCL Tech 27 Jul '10

27 Jul '10

Hi, I have one basic question in generating Accounting-Request and Response Authenticator generation. My config: NAS shared secret = testing123 Accounting server Secret = 123testing While generating Accounting-Request Authenticator which secret to use? NAS or Acct server secret? In Accounting Response: Which secret should be used to generate accounting response authenticator? Regards, Karthik DISCLAIMER: ----------------------------------------------------------------------------------------------------------------------- The contents of this e-mail and any attachment(s) are confidential and intended for the named recipient(s) only. It shall not attach any liability on the originator or HCL or its affiliates. Any views or opinions presented in this email are solely those of the author and may not necessarily reflect the opinions of HCL or its affiliates. Any form of reproduction, dissemination, copying, disclosure, modification, distribution and / or publication of this message without the prior written consent of the author of this e-mail is strictly prohibited. If you have received this email in error please delete it and notify the sender immediately. Before opening any mail and attachments please check them for viruses and defect. -----------------------------------------------------------------------------------------------------------------------

2 1