- Freeradius-Users - lists.freeradius.org

rlm_sql error, can't expand User-Password and Chap-Password, help me !
by VU VAN HUNG 23 Apr '10

23 Apr '10

Hi all, This is my first post. I'm trying to make a AAA server based on freeRadius and MySQL. After I configure radius server and run server in debug mode, I get some problem with rlm_sql about User-Password and Chap-Password. It seems that the server can't expand User-Password and Chap-Password. I don't know what's the problem. I hope that someones will give me advices. Here's my output from Radiusd -X command. rad_recv: Access-Request packet from host 192.168.0.6 port 1026, id=32, length=205 Sending duplicate reply to client RDLAB port 1026 - ID: 32 Sending Access-Challenge of id 32 to 192.168.0.6 port 1026 Waking up in 4.6 seconds. rad_recv: Access-Request packet from host 192.168.0.6 port 1026, id=33, length=205 User-Name = "hung" NAS-IP-Address = 192.168.0.6 NAS-Port = 0 Called-Station-Id = "00-02-6F-59-85-C7:RADIUS_TEST" Calling-Station-Id = "00-17-C4-8C-2C-C8" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020a002b19001703010020abe3291179889948f4ed41e6b8102d58aae4dc0f8400550f1d2d2fe050cc2dcb State = 0x296e680f21647160f77444525cb5459d Message-Authenticator = 0xe4889cb8f5e0e5104d92e7d3b13eef2a +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [eap] EAP packet type response id 10 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Received EAP-TLV response. [peap] Success [eap] Freeing handler ++[eap] returns ok Login OK: [hung] (from client RDLAB port 0 cli 00-17-C4-8C-2C-C8) +- entering group post-auth {...} [sql] expand: %{Stripped-User-Name} -> [sql] expand: %{User-Name} -> hung [sql] expand: %{%{User-Name}:-DEFAULT} -> hung [sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> hung [sql] sql_set_user escaped user --> 'hung' [*sql] expand: %{User-Password} -> [sql] expand: %{Chap-Password} -> * [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'hung', '', 'Access-Accept', '2010-04-21 20:22:27') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'hung', '', 'Access-Accept', '2010-04-21 20:22:27') *rlm_sql (sql): Reserving sql socket id: 2 rlm_sql_mysql: MYSQL check_error: 1054 received rlm_sql (sql) in sql_postauth: Database query error - Unknown column 'username' in 'field list'* rlm_sql (sql): Released sql socket id: 2 ++[sql] returns fail Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> hung attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 9 for 1 seconds Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 192.168.0.6 port 1026, id=33, length=205 Waiting to send Access-Reject to client RDLAB port 1026 - ID: 33 Waking up in 0.9 seconds. Sending delayed reject for request 9 Sending Access-Reject of id 33 to 192.168.0.6 port 1026 EAP-Message = 0x030a0004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.6 seconds. Best, Vu Hung,

3 7

Radius Attribute --> Authenticator IP Adress
by _Stefan_H 22 Apr '10

22 Apr '10

Hi, I thought that my Access-Point is able to handle VLAN-Attributes like my Switch but I was wrong. I don't want to tell the whole story. Is there an attribute which returns the authenticator IP-Address? For instance: The Access-Point has the IP-Adress 192.168.10.254 and the default rule in the users-file looks like this: DEFAULT Authenticator-Adress == 192.168.10.254 Auth-Type = Accept I know thats nonsens but thats only an example to show you what I mean. I looked at this site: http://freeradius.org/rfc/rfc2865.html http://freeradius.org/rfc/rfc2865.html but the NAS-IP is not the right thing and i don't unterstand the explanation of http://freeradius.org/rfc/rfc2865.html#Login-IP-Host Login-IP-Host Please help me and I know that my english is not the best -- View this message in context: http://old.nabble.com/Radius-Attribute---%3E-Authenticator-IP-Adress-tp2830… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 4

RE: radiusd does not logging while debug
by Harry Hoffman 22 Apr '10

22 Apr '10

Well, stderr in a foreground process is normally stdout. -----Original Message----- From: Johan Meiring <jmeiring(a)pcservices.co.za> Sent: Thursday, April 22, 2010 1:09 PM To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: radiusd does not logging while debug On 2010/04/22 06:45 PM, Alan DeKok wrote: > kes-kes(a)yandex.ru wrote: >> Hi, FreeRadius. >> >> How to force radiusd -X to do logging to log file too? > > $ radiusd -X> /var/log/radius/radius.log 2>&1 > Or for both file and console. radiusd -X 2>&1 | tee /var/log/radius/radius.log -- Johan Meiring Cape PC Services CC Tel: (021) 883-8271 Fax: (021) 886-7782 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

RE: radiusd does not logging while debug
by Harry Hoffman 22 Apr '10

22 Apr '10

Maybe (so you both see and log): Radiusd -X | tee -a /var/log/radius/radius-debug.log -----Original Message----- From: Alan DeKok <aland(a)deployingradius.com> Sent: Thursday, April 22, 2010 12:45 PM To: ??????? ??????? <kes-kes(a)yandex.ru>; FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: radiusd does not logging while debug kes-kes(a)yandex.ru wrote: > Hi, FreeRadius. > > How to force radiusd -X to do logging to log file too? $ radiusd -X > /var/log/radius/radius.log 2>&1 Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Zombie Infestation of Log file
by Benjamin Marvin 22 Apr '10

22 Apr '10

Good day, I'm trying to figure out why my servers continue to be marked zombie, even though they continue to handle traffic. There appears to be no impact, just seemingly erroneous - or at least unexplained - log entries. I have three 2.1.8 servers that feeds accounting to a 4th server (via copy_acct_to_homeserver), running 1.1.7. The primary servers also sends some auth (via proxy) and lots of acct (some via proxy, but also via copy_acct_to_homeserver) to a pair of Cisco ACS servers. The radius.log file for the primary servers show they are marking the 4th and Cisco (upstream) servers as zombie quite regularly (but not simultaneously); they thankfully never get marked dead. All of these servers are attached to the same Ethernet Switch with a slight detour through a Router that does VLAN routing between them; The Cisco servers also proxy to various other servers outside my network. I have a debug output from one of the servers that I have studied at length; I recorded the debug for 6 minutes or so before one of the servers was marked zombie. This is from a production machine with a fair amount of traffic, so the debug file is 9MBs. I'm not sure if it would be appropriate to post it to the mailing list. I'd be happy to post it. Do you want specific excerpts, or the whole thing? I've set the response_window to as high as 60 seconds in the clients.conf file and I keep the zombie_period at 20 seconds. I've also turned off the status_check feature as 1.1.7 and Cisco ACS do not appear to support it. The clients.conf file says that after the response_window is up (so 60 seconds) and "a" response is not received, that the server is marked Zombie. Based on what I see, I'm interpreting this as meaning that if one response is not seen in 60 seconds, even if hundreds of other responses were successfully sent and received during those 60 seconds, then the server is marked Zombie. At this point the Zombie_Period kicks in, and the moment "any" successful response is received the server is marked as completely alive. In my case the Zombie_Period is canceled immediately (though sadly the log does not seem to show when Zombie ends.) Odd to me is that occasionally a primary server will mark the same upstream server as Zombie multiple times over a handful of seconds, but the other two primary servers rarely mark upstream servers dead near the same time. I cannot find in the debug, or in packet captures, where a response went missing for a full minute, so I'm trying to find out what is happening. My upstream servers do not appear taxed or unresponsive. Perhaps there is some sort of malformed response I should be looking for? I also get radutmp errors about a wrong NAS ID, though on brief analysis it doesn't appear related. Any suggestions to help track this down and eliminate the error messages is greatly appreciated. -Benjamin

4 5

Dynamic Vlan assigment 802.1x with cisco
by Guillermo Borrallo 22 Apr '10

22 Apr '10

Hi, I have a problem to change vlan on a Catalyst 2950 switch using the 802.1x protocol. The problem is that no changes to the vlan you specified. The authentication and validation of the user is correct, but does not change vlan. Freeradius User Configuration: steve Cleartext-Password := "testing" Service-Type = Framed-User, Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID = 2 Switch 2950 configuration: aaa new-model aaa authentication login default local aaa authentication dot1x default group radius enable secret 5 $1$Hpyf$/AA8F3lVYES7KUq0abTqy. interface FastEthernet0/3 switchport mode access no ip address dot1x port-control auto interface Vlan1 ip address 192.168.250.250 255.255.255.0 no ip route-cache ip http server ip radius source-interface FastEthernet0/2 radius-server host 192.168.250.200 auth-port 1812 acct-port 1813 key password radius-server retransmit 3 no radius-server attribute nas-port privilege exec level 0 line show Right now, this created the vlan 1 and vlan 2 Thanks.Guillermo _________________________________________________________________ ¡Citas! ¡Ligues! ¿Salimos? ¿Cómo es tu pareja ideal? Búscala en el sitio nº1… ¡Regístrate ya! http://contactos.es.msn.com/?mtcmk=015352

3 4

DHCP with FreeRADIUS
by Jesús Jiménez 22 Apr '10

22 Apr '10

Hi, I'm having problems to configure the dhcp with freeradius (this is the first time :$) I have compiled it with the --with-dhcp option, and linked dhcp in sites-available. My dhcp server is 10.88.3.25 and the router is 10.88.3.1. I have only modified the dhcp configuration and the mac2ip file. This is the dhcp configuration: ______________________________________________ server dhcp { listen { ipaddr = * port = 67 type = "dhcp" interface = eth0 } dhcp DHCP-Discover { update reply { DHCP-Message-Type = DHCP-Offer } update reply { DHCP-Domain-Name-Server = 80.58.0.33 DHCP-Domain-Name-Server = 80.58.0.33 DHCP-Subnet-Mask = 255.255.255.0 DHCP-Router-Address = 10.88.3.1 DHCP-IP-Address-Lease-Time = 86400 DHCP-DHCP-Server-Identifier = 10.88.3.25 } mac2ip ok } dhcp DHCP-Request { update reply { DHCP-Message-Type = DHCP-Ack } update reply { DHCP-Domain-Name-Server = 80.58.0.33 DHCP-Domain-Name-Server = 80.58.0.33 DHCP-Subnet-Mask = 255.255.255.0 DHCP-Router-Address = 10.88.3.1 DHCP-IP-Address-Lease-Time = 86400 DHCP-DHCP-Server-Identifier = 10.88.3.25 DHCP-Gateway-IP-Address = 10.88.3.1 } mac2ip ok } dhcp { # send a DHCP NAK. reject } } _________________________________________________ I put the mac adress in mac2ip and it works, here is the file: fa:b3:77:de:25:6b,10.88.3.20 When I launch it in debug mode I have this exit: _________________________________________________ # freeradius -XX Tue Apr 20 13:26:13 2010 : Info: FreeRADIUS Version 2.1.8, for host i486-pc-linux-gnu, built on Apr 20 2010 at 13:19:48 Tue Apr 20 13:26:13 2010 : Info: Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. Tue Apr 20 13:26:13 2010 : Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Tue Apr 20 13:26:13 2010 : Info: PARTICULAR PURPOSE. Tue Apr 20 13:26:13 2010 : Info: You may redistribute copies of FreeRADIUS under the terms of the Tue Apr 20 13:26:13 2010 : Info: GNU General Public License v2. Tue Apr 20 13:26:13 2010 : Info: Starting - reading configuration files ... Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/radiusd.conf Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/proxy.conf Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/clients.conf Tue Apr 20 13:26:13 2010 : Debug: including files in directory /etc/freeradius/modules/ Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/krb5 Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/always Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/realm Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/radutmp Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/digest Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/mac2vlan Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/perl Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/checkval Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/sradutmp Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/ldap Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/expiration Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/ntlm_auth Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/preprocess Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/exec Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/pam Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/detail.example.com Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/passwd Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/echo Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/chap Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/inner-eap Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/policy Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/counter Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/smbpasswd Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/detail.log Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/unix Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/mschap Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/etc_group Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/files Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/smsotp Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/wimax Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/acct_unique Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/cui Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/linelog Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/detail Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/sql_log Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/otp Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/pap Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/mac2ip Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/attr_rewrite Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/ippool Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/expr Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/attr_filter Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/logintime Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/eap.conf Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/policy.conf Tue Apr 20 13:26:13 2010 : Debug: including files in directory /etc/freeradius/sites-enabled/ Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/sites-enabled/dhcp Tue Apr 20 13:26:13 2010 : Debug: main { Tue Apr 20 13:26:13 2010 : Debug: user = "freerad" Tue Apr 20 13:26:13 2010 : Debug: group = "freerad" Tue Apr 20 13:26:13 2010 : Debug: allow_core_dumps = no Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: including dictionary file /etc/freeradius/dictionary Tue Apr 20 13:26:13 2010 : Debug: main { Tue Apr 20 13:26:13 2010 : Debug: prefix = "/usr" Tue Apr 20 13:26:13 2010 : Debug: localstatedir = "/var" Tue Apr 20 13:26:13 2010 : Debug: logdir = "/var/log/freeradius" Tue Apr 20 13:26:13 2010 : Debug: libdir = "/usr/lib/freeradius" Tue Apr 20 13:26:13 2010 : Debug: radacctdir = "/var/log/freeradius/radacct" Tue Apr 20 13:26:13 2010 : Debug: hostname_lookups = no Tue Apr 20 13:26:13 2010 : Debug: max_request_time = 30 Tue Apr 20 13:26:13 2010 : Debug: cleanup_delay = 5 Tue Apr 20 13:26:13 2010 : Debug: max_requests = 1024 Tue Apr 20 13:26:13 2010 : Debug: pidfile = "/var/run/freeradius/freeradius.pid" Tue Apr 20 13:26:13 2010 : Debug: checkrad = "/usr/sbin/checkrad" Tue Apr 20 13:26:13 2010 : Debug: debug_level = 0 Tue Apr 20 13:26:13 2010 : Debug: proxy_requests = yes Tue Apr 20 13:26:13 2010 : Debug: log { Tue Apr 20 13:26:13 2010 : Debug: stripped_names = no Tue Apr 20 13:26:13 2010 : Debug: auth = no Tue Apr 20 13:26:13 2010 : Debug: auth_badpass = no Tue Apr 20 13:26:13 2010 : Debug: auth_goodpass = no Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: security { Tue Apr 20 13:26:13 2010 : Debug: max_attributes = 200 Tue Apr 20 13:26:13 2010 : Debug: reject_delay = 1 Tue Apr 20 13:26:13 2010 : Debug: status_server = yes Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: radiusd: #### Loading Realms and Home Servers #### Tue Apr 20 13:26:13 2010 : Debug: proxy server { Tue Apr 20 13:26:13 2010 : Debug: retry_delay = 5 Tue Apr 20 13:26:13 2010 : Debug: retry_count = 3 Tue Apr 20 13:26:13 2010 : Debug: default_fallback = no Tue Apr 20 13:26:13 2010 : Debug: dead_time = 120 Tue Apr 20 13:26:13 2010 : Debug: wake_all_if_all_dead = no Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: home_server localhost { Tue Apr 20 13:26:13 2010 : Debug: ipaddr = 127.0.0.1 Tue Apr 20 13:26:13 2010 : Debug: port = 1812 Tue Apr 20 13:26:13 2010 : Debug: type = "auth" Tue Apr 20 13:26:13 2010 : Debug: secret = "testing123" Tue Apr 20 13:26:13 2010 : Debug: response_window = 20 Tue Apr 20 13:26:13 2010 : Debug: max_outstanding = 65536 Tue Apr 20 13:26:13 2010 : Debug: require_message_authenticator = no Tue Apr 20 13:26:13 2010 : Debug: zombie_period = 40 Tue Apr 20 13:26:13 2010 : Debug: status_check = "status-server" Tue Apr 20 13:26:13 2010 : Debug: ping_interval = 30 Tue Apr 20 13:26:13 2010 : Debug: check_interval = 30 Tue Apr 20 13:26:13 2010 : Debug: num_answers_to_alive = 3 Tue Apr 20 13:26:13 2010 : Debug: num_pings_to_alive = 3 Tue Apr 20 13:26:13 2010 : Debug: revive_interval = 120 Tue Apr 20 13:26:13 2010 : Debug: status_check_timeout = 4 Tue Apr 20 13:26:13 2010 : Debug: irt = 2 Tue Apr 20 13:26:13 2010 : Debug: mrt = 16 Tue Apr 20 13:26:13 2010 : Debug: mrc = 5 Tue Apr 20 13:26:13 2010 : Debug: mrd = 30 Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: home_server_pool my_auth_failover { Tue Apr 20 13:26:13 2010 : Debug: type = fail-over Tue Apr 20 13:26:13 2010 : Debug: home_server = localhost Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: realm example.com { Tue Apr 20 13:26:13 2010 : Debug: auth_pool = my_auth_failover Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: realm LOCAL { Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: radiusd: #### Loading Clients #### Tue Apr 20 13:26:13 2010 : Debug: client localhost { Tue Apr 20 13:26:13 2010 : Debug: ipaddr = 127.0.0.1 Tue Apr 20 13:26:13 2010 : Debug: require_message_authenticator = no Tue Apr 20 13:26:13 2010 : Debug: secret = "testing123" Tue Apr 20 13:26:13 2010 : Debug: nastype = "other" Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: radiusd: #### Instantiating modules #### Tue Apr 20 13:26:13 2010 : Debug: instantiate { Tue Apr 20 13:26:13 2010 : Debug: (Loaded rlm_exec, checking if it's valid) Tue Apr 20 13:26:13 2010 : Debug: Module: Linked to module rlm_exec Tue Apr 20 13:26:13 2010 : Debug: Module: Instantiating exec Tue Apr 20 13:26:13 2010 : Debug: exec { Tue Apr 20 13:26:13 2010 : Debug: wait = no Tue Apr 20 13:26:13 2010 : Debug: input_pairs = "request" Tue Apr 20 13:26:13 2010 : Debug: shell_escape = yes Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: (Loaded rlm_expr, checking if it's valid) Tue Apr 20 13:26:13 2010 : Debug: Module: Linked to module rlm_expr Tue Apr 20 13:26:13 2010 : Debug: Module: Instantiating expr Tue Apr 20 13:26:13 2010 : Debug: (Loaded rlm_expiration, checking if it's valid) Tue Apr 20 13:26:13 2010 : Debug: Module: Linked to module rlm_expiration Tue Apr 20 13:26:13 2010 : Debug: Module: Instantiating expiration Tue Apr 20 13:26:13 2010 : Debug: expiration { Tue Apr 20 13:26:13 2010 : Debug: reply-message = "Password Has Expired " Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: (Loaded rlm_logintime, checking if it's valid) Tue Apr 20 13:26:13 2010 : Debug: Module: Linked to module rlm_logintime Tue Apr 20 13:26:13 2010 : Debug: Module: Instantiating logintime Tue Apr 20 13:26:13 2010 : Debug: logintime { Tue Apr 20 13:26:13 2010 : Debug: reply-message = "You are calling outside your allowed timespan " Tue Apr 20 13:26:13 2010 : Debug: minimum-timeout = 60 Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: radiusd: #### Loading Virtual Servers #### Tue Apr 20 13:26:13 2010 : Debug: server dhcp { Tue Apr 20 13:26:13 2010 : Debug: modules { Tue Apr 20 13:26:13 2010 : Debug: Module: Checking dhcp DHCP-Discover {...} for more modules to load Tue Apr 20 13:26:13 2010 : Debug: (Loaded rlm_passwd, checking if it's valid) Tue Apr 20 13:26:13 2010 : Debug: Module: Linked to module rlm_passwd Tue Apr 20 13:26:13 2010 : Debug: Module: Instantiating mac2ip Tue Apr 20 13:26:13 2010 : Debug: passwd mac2ip { Tue Apr 20 13:26:13 2010 : Debug: filename = "/etc/freeradius/mac2ip" Tue Apr 20 13:26:13 2010 : Debug: format = "*DHCP-Client-Hardware-Address:=DHCP-Your-IP-Address" Tue Apr 20 13:26:13 2010 : Debug: delimiter = "," Tue Apr 20 13:26:13 2010 : Debug: ignorenislike = yes Tue Apr 20 13:26:13 2010 : Debug: ignoreempty = yes Tue Apr 20 13:26:13 2010 : Debug: allowmultiplekeys = no Tue Apr 20 13:26:13 2010 : Debug: hashsize = 100 Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: rlm_passwd: nfields: 2 keyfield 0(DHCP-Client-Hardware-Address) listable: no Tue Apr 20 13:26:13 2010 : Debug: (Loaded rlm_always, checking if it's valid) Tue Apr 20 13:26:13 2010 : Debug: Module: Linked to module rlm_always Tue Apr 20 13:26:13 2010 : Debug: Module: Instantiating ok Tue Apr 20 13:26:13 2010 : Debug: always ok { Tue Apr 20 13:26:13 2010 : Debug: rcode = "ok" Tue Apr 20 13:26:13 2010 : Debug: simulcount = 0 Tue Apr 20 13:26:13 2010 : Debug: mpp = no Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: Module: Checking dhcp DHCP-Request {...} for more modules to load Tue Apr 20 13:26:13 2010 : Debug: Module: Checking dhcp (null) {...} for more modules to load Tue Apr 20 13:26:13 2010 : Error: /etc/freeradius/sites-enabled/dhcp[49]: No name specified for Post-Auth-Type block Tue Apr 20 13:26:13 2010 : Debug: } # modules Tue Apr 20 13:26:13 2010 : Debug: } # server Tue Apr 20 13:26:13 2010 : Debug: server { Tue Apr 20 13:26:13 2010 : Debug: modules { Tue Apr 20 13:26:13 2010 : Debug: } # modules Tue Apr 20 13:26:13 2010 : Debug: } # server Tue Apr 20 13:26:13 2010 : Debug: radiusd: #### Opening IP addresses and Ports #### Tue Apr 20 13:26:13 2010 : Debug: listen { Tue Apr 20 13:26:13 2010 : Debug: type = "auth" Tue Apr 20 13:26:13 2010 : Debug: ipaddr = * Tue Apr 20 13:26:13 2010 : Debug: port = 0 Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: listen { Tue Apr 20 13:26:13 2010 : Debug: type = "acct" Tue Apr 20 13:26:13 2010 : Debug: ipaddr = * Tue Apr 20 13:26:13 2010 : Debug: port = 0 Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: listen { Tue Apr 20 13:26:13 2010 : Debug: type = "dhcp" Tue Apr 20 13:26:13 2010 : Debug: ipaddr = * Tue Apr 20 13:26:13 2010 : Debug: port = 67 Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: Listening on authentication address * port 1812 Tue Apr 20 13:26:13 2010 : Debug: Listening on accounting address * port 1813 Tue Apr 20 13:26:13 2010 : Debug: Listening on dhcp interface eth0 address * port 67 as server dhcp Tue Apr 20 13:26:13 2010 : Debug: Listening on proxy address * port 1814 Tue Apr 20 13:26:13 2010 : Info: Ready to process requests. ____________________________________________________ and when I receive a dhcp-discover I have this: ____________________________________________________ Received DHCP-Discover of id 2b60f030 from 0.0.0.0:68 to 255.255.255.255:67 0: 01 01 06 00 2b 60 f0 30 00 00 00 00 00 00 00 00 16: 00 00 00 00 00 00 00 00 00 00 00 00 fa b3 77 de 32: 25 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 64: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 96: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 112: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 128: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 144: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 176: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 192: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 208: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 224: 00 00 00 00 00 00 00 00 00 00 00 00 63 82 53 63 240: 35 01 01 37 0c 01 1c 02 03 0f 06 77 0c 2c 2f 1a 256: 79 ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 272: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 288: 00 00 00 00 00 00 00 00 00 00 00 00 DHCP-Opcode = Client-Message DHCP-Hardware-Type = Ethernet DHCP-Hardware-Address-Length = 6 DHCP-Hop-Count = 0 DHCP-Transaction-Id = 727773232 DHCP-Number-of-Seconds = 0 DHCP-Flags = 0 DHCP-Client-IP-Address = 0.0.0.0 DHCP-Your-IP-Address = 0.0.0.0 DHCP-Server-IP-Address = 0.0.0.0 DHCP-Gateway-IP-Address = 0.0.0.0 DHCP-Client-Hardware-Address = fa:b3:77:de:25:6b DHCP-Message-Type = DHCP-Discover DHCP-Parameter-Request-List = DHCP-Subnet-Mask DHCP-Parameter-Request-List = DHCP-Broadcast-Address DHCP-Parameter-Request-List = DHCP-Time-Offset DHCP-Parameter-Request-List = DHCP-Router-Address DHCP-Parameter-Request-List = DHCP-Domain-Name DHCP-Parameter-Request-List = DHCP-Domain-Name-Server DHCP-Parameter-Request-List = DHCP-Domain-Search DHCP-Parameter-Request-List = DHCP-Hostname DHCP-Parameter-Request-List = DHCP-NETBIOS-Name-Servers DHCP-Parameter-Request-List = DHCP-NETBIOS DHCP-Parameter-Request-List = DHCP-Interface-MTU-Size DHCP-Parameter-Request-List = DHCP-Classless-Static-Route Tue Apr 20 13:29:27 2010 : Info: server dhcp { Tue Apr 20 13:29:27 2010 : Debug: Trying sub-section dhcp DHCP-Discover {...} Tue Apr 20 13:29:27 2010 : Info: +- entering group DHCP-Discover {...} Tue Apr 20 13:29:27 2010 : Info: ++[reply] returns noop Tue Apr 20 13:29:27 2010 : Info: ++[reply] returns noop Tue Apr 20 13:29:27 2010 : Info: [mac2ip] Added DHCP-Your-IP-Address: '10.88.3.20' to reply_items Tue Apr 20 13:29:27 2010 : Info: ++[mac2ip] returns ok Tue Apr 20 13:29:27 2010 : Info: ++[ok] returns ok Tue Apr 20 13:29:27 2010 : Info: } # server dhcp Sending DHCP-Offer of id 2b60f030 from 0.0.0.0:67 to 255.255.255.255:68 DHCP-Opcode = Server-Message DHCP-Hardware-Type = Ethernet DHCP-Hardware-Address-Length = 6 DHCP-Hop-Count = 0 DHCP-Transaction-Id = 727773232 DHCP-Number-of-Seconds = 0 DHCP-Flags = 0 DHCP-Client-IP-Address = 0.0.0.0 DHCP-Your-IP-Address = 10.88.3.20 DHCP-Server-IP-Address = 10.88.3.25 DHCP-Gateway-IP-Address = 0.0.0.0 DHCP-Client-Hardware-Address = fa:b3:77:de:25:6b DHCP-Server-Host-Name = "" DHCP-Boot-Filename = "" DHCP-Subnet-Mask = 255.255.255.0 DHCP-Router-Address = 10.88.3.1 DHCP-Domain-Name-Server = 80.58.0.33 DHCP-Domain-Name-Server = 80.58.0.33 DHCP-IP-Address-Lease-Time = 86400 DHCP-DHCP-Server-Identifier = 10.88.3.25 0: 02 01 06 00 2b 60 f0 30 00 00 00 00 00 00 00 00 16: 0a 58 03 14 0a 58 03 19 00 00 00 00 fa b3 77 de 32: 25 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 64: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 96: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 112: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 128: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 144: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 176: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 192: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 208: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 224: 00 00 00 00 00 00 00 00 00 00 00 00 63 82 53 63 240: 35 01 02 01 04 ff ff ff 00 03 04 0a 58 03 01 06 256: 08 50 3a 00 21 50 3a 00 21 33 04 00 01 51 80 36 272: 04 0a 58 03 19 ff 00 00 00 00 00 00 00 00 00 00 288: 00 00 00 00 00 00 00 00 00 00 00 00 Error on call sendmsg: Invalid argument errno = 22. _____________________________________________________ It looks like it's sending the dhcp response but with tcpdump I can't see anything (of the response), the I decided to see the code and went to the call sendmsg in src/lib/udpfromto.c and change this: << return sendmsg(s, &msgh, flags); << >> int res = sendmsg(s, &msgh, flags); if (res == -1){ perror("Error on call sendmsg"); printf("errno = %d. \n", errno); exit(1); } return res; >> I think its something of the configuration. I someone can help me I'll be really grateful. Sorry for my english :D Jewi.

2 2

Re: Zombie Infestation of Log file‏
by Benjamin Marvin 22 Apr '10

22 Apr '10

> usually because the remote server is not listening on its accounting > port or not configured for accounting - the proxy in the middle > doesn't get a response so cant respond to you - hence zombie. I don't believe this is my problem. The debug and packet captures show all of the accounting packets are replied to within the Response_Window and Max_Request_Time frames. (5-10 seconds being at the extreme high end of response times.) -Benjamin

2 1

Re: Zombie Infestation of Log file‏
by Benjamin Marvin 22 Apr '10

22 Apr '10

Thank you both for your thoughts. I will implement the status_check = request option (in proxy.conf, sorry I mis-remembered it as client.conf) per your recommendations. I've also balanced out the response_window and max_request_time. Any other suggestions on where I should look to see why the servers are marking the upstream servers as Zombie? I failed to mention that the servers are marking only the accounting port on those servers as Zombie. Please let me know if you want the 9MB debug or if you have recommendations for making a smaller debug file. -Benjamin Josip Rodin wrote: >On Tue, Apr 20, 2010 at 10:59:04PM -0800, Benjamin Marvin wrote: >> I've also turned off the status_check feature as 1.1.7 and Cisco ACS do >> not appear to support it. You can configure a fake username && password for status checks. This *is* documented in raddb/proxy.conf. > Without status_check, you rely on the timeouts - revive_interval and > zombie_period. Which is much worse than status checks. > But, if you're talking to FR 1.1.7, that should be able to make it respond > negatively to a single fake user/domain, and then you can use that for > status_check = request on its clients. > > *Any* status_check is better on FR 2.x than none... speaking from horrible > experience... Yup. It's not that 2.x is bad without status checks, it's that there is *no way* for anyone to do "the right thing" without status checks. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

VLAN Attribute ?
by Fabien COMBERNOUS 21 Apr '10

21 Apr '10

Hi, I'm seting up a FreeRadius Server using SQL backend to store informations about NAS, Users and Groups. I search the Attribute to use to allow a group in a VLAN of my switch. My setup permit to authenticate a user and the group of the user. But what is the attribute to use in table radreply or radgroupreply to put the port of my switch in the good vlan ? Best regards, -- *Fabien COMBERNOUS* /unix system engineer/ www.kezia.com <http://www.kezia.com/> *Tel: +33 (0) 467 992 986* Kezia Group

3 4