- Freeradius-Users - lists.freeradius.org

Wimax module with Freeradius 2.1.8 on Ubuntu
by Lindsay, Joel 30 Mar '10

30 Mar '10

Hi, I am using ubuntu and wanted to install freeradius. After installing the default unbuntu version of freeradius, I realised that it does not support WiMAX. I then removed the old version, downloaded the latest version of freeradius (2.1.8) and built my own package according to the build instructions on the freeradius Wiki. This did not appear to build the wimax portions as freeradius crashed stating it could not find the shared rlm_wimax.so file (when I ran the server with wimax eneabled in the defaults file. I built this file myself and linked it into the directory where all the other freeradius libraries go. This allowed me to start freeradius, but on the first authentication request, I get a segmentation fault. I attempted to recompile from source using ./configure -with-experimental-modules and make. Unfortunately this too failed to compile the WiMAX module. Does anyone know what I am doing wrong here? Thanks for the help! __________________________________________________________ Joel Lindsay

3 2

Help: Radius Accounting Request and Message Authenticator
by Alessio Grasso 30 Mar '10

30 Mar '10

Hi all, I'm a ICLoS's software engineering and I'm developing a WiMax ASN. I had already develop the client authentication and authorization modules for freeradius 2.1.8, successfully (EAP-TTLS). Now I'm building the Radius Accounting module but I have a problem with the Request-Authenticator find in the message of Accounting-Request. When I send a Radius Accounting-Request, the server's log shows: Received packet from 192.168.2.130 with invalid Message-Authenticator! (Shared secret is incorrect.) Dropping packet without response. I think it's wrong to calculate HMAC-MD5 (is it exactly the same to the case of Authentication Request?). I'm studing on the RFC 2866 but I found that there are only 16 octets to zero in the Authenticator field. Where can I found further informations? Thanks in advance, Alessio Grasso

2 1

Re: Memory Leak on version 2.1.3
by Gary Gatten 30 Mar '10

30 Mar '10

there are at least 3 newer versions. Have you tried the latest and/or read the changelog? ----- Original Message ----- From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org <freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Wed Mar 24 18:24:54 2010 Subject: Memory Leak on version 2.1.3 Hi, I am using 2.1.3 freeradius server and found memory leak. I use ttls+mschapv2 for authentication. After each authentication, the memory usage increases. Is there a patch fix for this? Thanks, Gina Zhang - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

5 9

Re: Freeradius, Active Directory and User's Group
by Gary Gatten 30 Mar '10

30 Mar '10

FWIW, I do group checking with SAMBA. I'm not in front of my system, but there's an arg one can pass to the Samba util exe where it will validate uname, password, and group membership. This should work for most "simple" confs, although I can certainly envision situations where LDAP may be required. ----- Original Message ----- From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org <freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Mon Mar 29 15:26:57 2010 Subject: Re: Freeradius, Active Directory and User's Group Understood, but the freeradius will be able to return this group information to the Alcatel device? Regards Lincoln On Mon, Mar 29, 2010 at 5:10 PM, John Dennis <jdennis(a)redhat.com> wrote: > On 03/29/2010 04:02 PM, Lincoln Zuljewic Silva wrote: >> >> I'm sorry. >> >> I forgot to mention that I'm not using LDAP, but Samba to integrate >> the freeradius with AD. > > O.K. I presume you're using samba for authentication, but where are you > storing the information about which groups a user is in? I presume it's in > AD. AD is an ldap server that you can query during authorization which is > when and where you would do the group check. > -- > John Dennis <jdennis(a)redhat.com> > > Looking to carve out IT costs? > www.redhat.com/carveoutcosts/ > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > -- Lincoln Zuljewic Silva More contact info.: http://www.system.adm.br/contact.php "How often must a question be asked before it’s considered a frequently asked question?" - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 4

Freeradius, Active Directory and User's Group
by Lincoln Zuljewic Silva 29 Mar '10

29 Mar '10

Good afternoon. I have a freeradius server to authenticate a Alcatel device (Alcatel 5620 SAM). The freeradius server is passing requests for an AD that returns OK / NOK for authentication. This part is working. However, I need the freeradius check if the users are part of some groups. Is this possible? I've searched the Internet and read the documentation in freeradius.oef, but did not find anything about it. I'm using freeradius version 2.1.8. Best regards... Lincoln Zuljewic Silva More contact info.: http://www.system.adm.br/contact.php "How often must a question be asked before it’s considered a frequently asked question?"

2 4

Dan Schaffer is not in the office
by Dan Schaffer 29 Mar '10

29 Mar '10

I will be out of the office starting 03/29/2010 and will not return until 04/01/2010. I will have limited email and voicemail access during the week at the Phoenix Contact Kickoff meetings. If this is an urgent issue, please contact our Tech Support group at 800-586-5525. Thanks, Dan

1 0

Setting VLAN from inner-tunnel
by Ben Thompson 29 Mar '10

29 Mar '10

Hi I am trying to assign a VLAN for PEAP and TTLS clients using a section like this in the inner-tunnel configuration:- update outer.reply { Tunnel-Private-Group-ID := 123 Tunnel-Type := VLAN Tunnel-Medium-Type := IEEE-802 } However, I can't get it to work. The attributes are added and in the debug I can see that they go to the NAS in the access-challenge sections but they are not present in the final access-accept. Is there any way to make this work? Thanks -- Ben Thompson

4 5

duplicate errors in an active directory setup
by Christian Pinedo Zamalloa 29 Mar '10

29 Mar '10

Hi all, I'm using FreeRadius 2.1.8 to authenticate wifi users againts an Active Directory. The setup consists on samba, kerberos and freeradius. All seem to be working well but FreeRadius logs are full of the following errors: Mon Mar 15 18:57:09 2010 : Error: Discarding duplicate request from client ccc port 32768 - ID: 85 due to unfinished request 28810 Mon Mar 15 18:57:14 2010 : Error: Discarding duplicate request from client ccc port 32768 - ID: 85 due to unfinished request 28810 Mon Mar 15 18:57:19 2010 : Error: Discarding duplicate request from client ccc port 32768 - ID: 85 due to unfinished request 28810 Mon Mar 15 18:57:24 2010 : Error: Discarding duplicate request from client ccc port 32768 - ID: 85 due to unfinished request 28810 Mon Mar 15 18:57:28 2010 : Error: Discarding duplicate request from client ccc port 32768 - ID: 86 due to unfinished request 28823 Mon Mar 15 18:57:33 2010 : Error: Discarding duplicate request from client ccc port 32768 - ID: 86 due to unfinished request 28823 I don't know if it is a common issue in a deployment based on active directory or if something could be wrong. Winbind also gives me a lot of warning/errors: Mar 16 16:20:24 radius01 winbindd[2640]: [2010/03/16 16:20:24, 0] libsmb/credentials.c:creds_client_check(324) Mar 16 16:20:24 radius01 winbindd[2640]: creds_client_check: credentials check failed. Mar 16 16:20:24 radius01 winbindd[2640]: [2010/03/16 16:20:24, 0] rpc_client/cli_netlogon.c:rpccli_netlogon_sam_network_logon(1019) Mar 16 16:20:24 radius01 winbindd[2640]: rpccli_netlogon_sam_network_logon: credentials chain check failed Mar 16 16:20:24 radius01 winbindd[2640]: [2010/03/16 16:20:24, 0] libsmb/cliconnect.c:cli_session_setup_spnego(859) Mar 16 16:20:24 radius01 winbindd[2640]: Kinit failed: KDC reply did not match expectations Mar 16 16:22:59 radius01 winbindd[19653]: [2010/03/16 16:22:59, 0] libsmb/cliconnect.c:cli_session_setup_spnego(859) Mar 16 16:22:59 radius01 winbindd[19653]: Kinit failed: KDC reply did not match expectations Mar 16 16:22:59 radius01 winbindd[2640]: [2010/03/16 16:22:59, 0] libsmb/credentials.c:creds_client_check(324) Mar 16 16:22:59 radius01 winbindd[2640]: creds_client_check: credentials check failed. Mar 16 16:22:59 radius01 winbindd[2640]: [2010/03/16 16:22:59, 0] rpc_client/cli_netlogon.c:rpccli_netlogon_sam_network_logon(1019) Mar 16 16:22:59 radius01 winbindd[2640]: rpccli_netlogon_sam_network_logon: credentials chain check failed Mar 16 16:22:59 radius01 winbindd[2640]: [2010/03/16 16:22:59, 0] libsmb/cliconnect.c:cli_session_setup_spnego(859) Mar 16 16:22:59 radius01 winbindd[2640]: Kinit failed: KDC reply did not match expectations Mar 16 16:27:59 radius01 winbindd[19665]: [2010/03/16 16:27:59, 0] libsmb/cliconnect.c:cli_session_setup_spnego(859) Mar 16 16:27:59 radius01 winbindd[19665]: Kinit failed: KDC reply did not match expectations Mar 16 16:33:00 radius01 winbindd[19731]: [2010/03/16 16:33:00, 0] libsmb/cliconnect.c:cli_session_setup_spnego(859) Mar 16 16:33:00 radius01 winbindd[19731]: Kinit failed: KDC reply did not match expectations Authentication is working but i don't know if i should be worried about these logs. Can you tell me? Thanks in advance, -- Christian Pinedo Zamalloa (zako) PGP keyID: 0x828D0C80 Fingerprint: 7BFF 4105 F46B 7977 BD96 348C 1007 4FF8 828D 0C80

3 4

Problem changing secret in clients.conf
by Marta Jiménez García 28 Mar '10

28 Mar '10

Hello! I'm totally new in Linux, as well as in freeradius... I've installed version 2.1.8 in Linuxmint 7. I think everything in installation went ok... I succeed doing: $ radtest user password 127.0.0.1 10 testing123 with user/password the ones that I use to login in my computer. I get a response Access-Accept (I had some problems here because I wasn't able to get an accept using localhost instead of 127.0.0.1 ...) I'm now in the next step. I want to change the secret in clients.conf, so I made the change: #secret = testing123 secret = abracadabra I stopped radiusd and started again. $ radtest user password 127.0.0.1 10 abracadabra doesn't work any more... and I don't understand why... because I'm using the same word. *rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=146, length=20 rad_verify: Received Access-Reject packet from client 127.0.0.1 port 1812 with invalid signature (err=2)! (Shared secret is incorrect.)* I get this log: rad_recv: Access-Request packet from host 127.0.0.1 port 34217, id=146, length=60 User-Name = "mjimenez" User-Password = "\353\036\355h\203l\217\362\252\003\203P\270\223\342\231" NAS-IP-Address = 127.0.1.1 NAS-Port = 10 Sat Mar 27 18:59:31 2010 : Info: +- entering group authorize {...} Sat Mar 27 18:59:31 2010 : Info: ++[preprocess] returns ok Sat Mar 27 18:59:31 2010 : Info: ++[chap] returns noop Sat Mar 27 18:59:31 2010 : Info: ++[mschap] returns noop Sat Mar 27 18:59:31 2010 : Info: [suffix] No '@' in User-Name = "mjimenez", looking up realm NULL Sat Mar 27 18:59:31 2010 : Info: [suffix] No such realm "NULL" Sat Mar 27 18:59:31 2010 : Info: ++[suffix] returns noop Sat Mar 27 18:59:31 2010 : Info: [eap] No EAP-Message, not doing EAP Sat Mar 27 18:59:31 2010 : Info: ++[eap] returns noop Sat Mar 27 18:59:31 2010 : Info: ++[unix] returns updated Sat Mar 27 18:59:31 2010 : Info: ++[files] returns noop Sat Mar 27 18:59:31 2010 : Info: ++[expiration] returns noop Sat Mar 27 18:59:31 2010 : Info: ++[logintime] returns noop Sat Mar 27 18:59:31 2010 : Info: ++[pap] returns updated Sat Mar 27 18:59:31 2010 : Info: Found Auth-Type = PAP Sat Mar 27 18:59:31 2010 : Info: +- entering group PAP {...} Sat Mar 27 18:59:31 2010 : Info: [pap] login attempt with password "�?�h?l?��??P�?�?" Sat Mar 27 18:59:31 2010 : Info: [pap] Using CRYPT encryption. Sat Mar 27 18:59:31 2010 : Info: [pap] Passwords don't match Sat Mar 27 18:59:31 2010 : Info: ++[pap] returns reject Sat Mar 27 18:59:31 2010 : Info: Failed to authenticate the user. Sat Mar 27 18:59:31 2010 : Debug: WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! Sat Mar 27 18:59:31 2010 : Info: Using Post-Auth-Type Reject Sat Mar 27 18:59:31 2010 : Info: +- entering group REJECT {...} Sat Mar 27 18:59:31 2010 : Info: [attr_filter.access_reject] expand: %{User-Name} -> mjimenez Sat Mar 27 18:59:31 2010 : Debug: attr_filter: Matched entry DEFAULT at line 11 Sat Mar 27 18:59:31 2010 : Info: ++[attr_filter.access_reject] returns updated Sat Mar 27 18:59:31 2010 : Info: Delaying reject of request 0 for 1 seconds Sat Mar 27 18:59:31 2010 : Debug: Going to the next request Sat Mar 27 18:59:31 2010 : Debug: Waking up in 0.9 seconds. Sat Mar 27 18:59:32 2010 : Info: Sending delayed reject for request 0 Sending Access-Reject of id 146 to 127.0.0.1 port 34217 Sat Mar 27 18:59:32 2010 : Debug: Waking up in 4.9 seconds. Sat Mar 27 18:59:37 2010 : Info: Cleaning up request 0 ID 146 with timestamp +9 When I had testing123 as secret, in User-Password I could see "my real password" and not "\353\036\355h\203l\217\362\252\00..."* * I have checked I have this line in radiusd.conf : $INCLUDE clients.conf * * Maybe is a stupid question and I've to change something more in another conf file. I've not started configuring my NAS yet... I was trying to configure radius first and checking with radtest step by step.* * Thank you in advance for any help you can give me, Marta

4 5

Help with executing accounting!
by Mohamed Abdulla 28 Mar '10

28 Mar '10

Hi All, I am new to using freeradius. I am in the process of integrating freeradius with "ipoque", which is a bandwidth control device. IPOQUE expects to see an accounting request from the radius server with specific attributes embedded, in order to control the bandwidth of the logged-in user. The scenario I am trying to realize is as follows: 1.. For each user wishing to authenticate with freeradius, I have added two attributes in "users.conf" file. The first attribute is "Framed-IP-Address", while the second is a VSA "ipoque-class". 2.. When the user successfully authenticate with the freeradius, and after the freeradius sends Access-Accept, I want the radclient.exe to automatically send Accounting request to ipoque, including the following: User-Name, Framed-IP-Address, Accounting-Status-Type= Start and ipoque-class as configured in users.conf file. This should inform ipoque device about the user IP and the class of that user in order to apply th proper bandwidth rules for that user category. I have started by creating a test user in users.conf as follows: shafzeen Auth-Type := Local, User-Password == "1234" Framed-IP-Address = "192.168.1.12", ipoque-class = "raduser" then I created a text file named "ipoquestart.txt" with the following content: User-Name = "%{User-Name}", Framed-IP-Address = "%{reply:Framed-IP-Address}", Acct-Status-Type = Start, ipoque-class = "%{reply:ipoque-class}" Then in the radiusd.conf, in the modules section I have defined the following (The ipoque device IP is 192.168.0.1, secret "prx"): exec Start { wait = yes program = "${bindir}/radclient.exe -d ${raddbdir} -f ${bindir}/ipoquestart.txt -x -s 192.168.1 acct prx" input_pairs = reply output_pairs = reply packet_type = Access-Accept } and in the instantiate section I have added Start. Also, in the post-auth I have put Start trying to send the radclient acct request towards ipoque. I have started freeradius in debug mode, and I noticed that the radclient is sending Framed-IP-Address as "0.0.0.0", and "ipoque-class"= "", and after that it is sending the reply with the needed values of Framed-IP-Address and "ipoque-class". I know there is some where something wrong I am doing, but I need someone to analyse what is happening and tell me how to correct it! Thanks

4 7