- Freeradius-Users - lists.freeradius.org

mschap2 over peap, how to use cleartext password defined on the freeradius server instead of using Windows AD?
by Difan Zhao 07 Jan '10

07 Jan '10

Greetings! I did read the "mschap" module file and I did see that in order to use a cleartext password, I need to set "MS-CHAP-Use-NTLM-Auth := No" however I don't know where to set it. I tried to set it in "hints" file like the following. I added it to the beginning of the file and the rest is just default. enseo_stb MS-CHAP-Use-NTLM-Auth := No The "enseo_stb" is the username. I do see that it matched the line in the preprocess in the debug however the authentication still failed. I don't have this user account set in Windows AD. I do have it set in my users file. Enseo_stb Cleartext-Password := "password" Any advice?? Thank you!! Difan Zhao Network Engineer difan.zhao(a)guest-tek.com www.guest-tek.com <http://www.guest-tek.com/> Office: 403-509-1010 ext 3048 Cell: 403-689-7514

2 1

On-line debugging tool
by Alan DeKok 07 Jan '10

07 Jan '10

I've put a debugging tool online at: http://networkradius.com/ Click on the "debug tool" link on the left, under "News". The page contains instructions for how to get debug output into the form. The main purpose of the tool is to teach people what is important in the debug output, and what can be safely ignored. Important data is highlighted (red, yellow, blue), and less important data is de-emphasized (text is light grey). Each packet received / sent is put into its own text box. This separation allows you to quickly find the output for just one packet out of many. The tool is in "beta", and likely produces less useful output when the server is proxying packets. It's best used to debug local authentication issues. We hope you find the web tool useful. Please send any feedback privately to me. Alan DeKok.

3 5

Radiusd process exited without notice
by Dinh Pham Cong 07 Jan '10

07 Jan '10

Hi all, I noticed that my radiusd process exited silently this morning without any notice before I must start it manually at Mon Dec 21 10:42:23 2009 as you can see in the below log messages. Besides, no crash is recorded in /var/log/messages. Any recommendation to troubleshoot this problem is appreciated. Sun Dec 20 21:37:51 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.34.22', nas '10.0.41.137'] Sun Dec 20 21:39:26 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.70.57', nas '10.0.41.138'] Sun Dec 20 22:00:52 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.36.222', nas '10.0.41.138'] Sun Dec 20 22:04:04 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.115.184', nas '10.0.41.138'] Sun Dec 20 22:15:23 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.66.205', nas '10.0.41.138'] Sun Dec 20 22:33:15 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.36.99', nas '10.0.41.138'] Sun Dec 20 22:51:12 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.49.23', nas '10.0.41.137'] Sun Dec 20 23:30:07 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.108.156', nas '10.0.41.138'] Sun Dec 20 23:35:32 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.64.196', nas '10.0.41.137'] Mon Dec 21 00:35:44 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.52.91', nas '10.0.41.137'] Mon Dec 21 01:44:33 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.16.35', nas '10.0.41.138'] Mon Dec 21 03:28:49 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.8.63', nas '10.0.41.138'] Mon Dec 21 03:55:37 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.48.182', nas '10.0.41.137'] Mon Dec 21 04:27:51 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.33.43', nas '10.0.41.137'] Mon Dec 21 05:45:55 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.32.232', nas '10.0.41.138'] Mon Dec 21 05:55:46 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.69.204', nas '10.0.41.138'] Mon Dec 21 06:51:41 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.26.247', nas '10.0.41.137'] Mon Dec 21 06:56:50 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.24.21', nas '10.0.41.138'] Mon Dec 21 08:27:47 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.8.85', nas '10.0.41.138'] Mon Dec 21 08:36:01 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.138.176', nas '10.0.41.137'] Mon Dec 21 08:42:41 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.68.198', nas '10.0.41.137'] Mon Dec 21 08:46:53 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.26.233', nas '10.0.41.137'] Mon Dec 21 09:07:01 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.110.49', nas '10.0.41.137'] Mon Dec 21 09:14:04 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.35.224', nas '10.0.41.137'] Mon Dec 21 09:36:55 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.65.233', nas '10.0.41.138'] Mon Dec 21 09:41:02 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.39.177', nas '10.0.41.138'] Mon Dec 21 10:04:22 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.12.71', nas '10.0.41.137'] Mon Dec 21 10:04:23 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.52.107', nas '10.0.41.137'] Mon Dec 21 10:04:23 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.82.155', nas '10.0.41.137'] Mon Dec 21 10:04:24 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.14.240', nas '10.0.41.137'] Mon Dec 21 10:04:26 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.31.29', nas '10.0.41.137'] Mon Dec 21 10:04:26 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.24.30', nas '10.0.41.137'] Mon Dec 21 10:04:26 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.25.245', nas '10.0.41.138'] Mon Dec 21 10:04:26 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.25.49', nas '10.0.41.138'] Mon Dec 21 10:04:27 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.35.84', nas '10.0.41.137'] Mon Dec 21 10:04:27 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.51.7', nas '10.0.41.138'] Mon Dec 21 10:04:27 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.8.155', nas '10.0.41.137'] Mon Dec 21 10:04:27 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.39.232', nas '10.0.41.138'] Mon Dec 21 10:04:27 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Dec 21 10:04:27 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.37.42', nas '10.0.41.138'] Mon Dec 21 10:04:27 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.69.183', nas '10.0.41.138'] Mon Dec 21 10:04:27 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.28.249', nas '10.0.41.138'] Mon Dec 21 10:04:27 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.48.247', nas '10.0.41.137'] Mon Dec 21 10:04:28 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Dec 21 10:04:28 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.49.162', nas '10.0.41.137'] Mon Dec 21 10:04:28 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.58.116', nas '10.0.41.137'] Mon Dec 21 10:04:28 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.12.154', nas '10.0.41.138'] Mon Dec 21 10:04:28 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.58.93', nas '10.0.41.138'] Mon Dec 21 10:04:29 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Dec 21 10:04:29 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.34.116', nas '10.0.41.138'] Mon Dec 21 10:04:29 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.110.54', nas '10.0.41.138'] Mon Dec 21 10:04:29 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.27.8', nas '10.0.41.137'] Mon Dec 21 10:04:29 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.105.31', nas '10.0.41.137'] Mon Dec 21 10:04:29 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.0.44', nas '10.0.41.138'] Mon Dec 21 10:04:30 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Dec 21 10:04:30 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.38.21', nas '10.0.41.138'] Mon Dec 21 10:04:30 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.67.0', nas '10.0.41.137'] Mon Dec 21 10:04:31 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.81.41', nas '10.0.41.137'] Mon Dec 21 10:04:31 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.26.205', nas '10.0.41.137'] Mon Dec 21 10:04:31 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.112.205', nas '10.0.41.138'] Mon Dec 21 10:04:31 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.53.225', nas '10.0.41.138'] Mon Dec 21 10:04:31 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.38.170', nas '10.0.41.138'] Mon Dec 21 10:04:32 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.13.15', nas '10.0.41.138'] Mon Dec 21 10:04:32 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.58.157', nas '10.0.41.138'] Mon Dec 21 10:04:32 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.48.134', nas '10.0.41.138'] Mon Dec 21 10:04:32 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.69.19', nas '10.0.41.137'] Mon Dec 21 10:04:32 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.54.41', nas '10.0.41.138'] Mon Dec 21 10:04:32 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.109.253', nas '10.0.41.138'] Mon Dec 21 10:04:32 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.91.90', nas '10.0.41.138'] Mon Dec 21 10:04:32 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.87.73', nas '10.0.41.137'] Mon Dec 21 10:04:32 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.29.105', nas '10.0.41.138'] Mon Dec 21 10:04:33 2009 : Error: Received conflicting packet from client vt-ggsn3-sg port 51682 - ID: 192 due to unfinished request 20099379. Giving up on old request. Mon Dec 21 10:04:33 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.95.191', nas '10.0.41.138'] Mon Dec 21 10:04:33 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.40.108', nas '10.0.41.138'] Mon Dec 21 10:04:33 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.12.148', nas '10.0.41.137'] Mon Dec 21 10:04:33 2009 : Error: Received conflicting packet from client vt-ggsn8-tt port 57385 - ID: 143 due to unfinished request 20099602. Giving up on old request. Mon Dec 21 10:04:33 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #71 Mon Dec 21 10:42:23 2009 : Info: Loaded virtual server inner-tunnel Mon Dec 21 10:42:23 2009 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Mon Dec 21 10:42:23 2009 : Info: rlm_sql (sql): Attempting to connect to radius@localhost:/radius Mon Dec 21 10:42:23 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Mon Dec 21 10:42:23 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Mon Dec 21 10:42:23 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Mon Dec 21 10:42:23 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Mon Dec 21 10:42:23 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Mon Dec 21 10:42:23 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #5 Mon Dec 21 10:42:23 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #6 Mon Dec 21 10:42:23 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #7 Mon Dec 21 10:42:23 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #8 Mon Dec 21 10:42:23 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #9 Mon Dec 21 10:42:23 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #10 Mon Dec 21 10:42:23 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #11 Mon Dec 21 10:42:23 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #12 Mon Dec 21 10:42:23 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #13 Mon Dec 21 10:42:23 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #14 Mon Dec 21 10:42:23 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #15 Regards, Dinh

5 14

only accept PEAP-MSCHAPv2 with "EAP-TLS-Require-Client-Cert = Yes"
by Vieri 07 Jan '10

07 Jan '10

Hi, I setup freeradius to accept authentications using PEAP-MSCHAPv2 with client certificates via "EAP-TLS-Require-Client-Cert = Yes". However, clients who authenticate via EAP-TLS also succeed. How can I reject all auth types except PEAP-MSCHAPv2 with "EAP-TLS-Require-Client-Cert = Yes"? (ie. I require both client certificates and username/password.) Thanks, Vieri

2 1

Managing the RADIUS database
by Steve Bertrand 06 Jan '10

06 Jan '10

Hi all, I'm curious to know what you use to manage your RADIUS database, particularly the accounting tables. For quite some time, I was using severely hacked versions of the dialup_admin scripts. Since then, I've written (ie. been writing) an ISP mgmt/accounting system that relies very heavily on the RADIUS accounting information for billing and statistics, but only after the data has been aggregated. During this project, I've also written a basic object-oriented RADIUS module that now houses the aggregation functionality, including being able to go back in time to re-aggregate and re-archive. Because I need to make some functional changes to it, I thought I'd ask here if others would be interested in such a Perl module (and its scripts), and if so, I'll extend it with further functionality after updating the code with the stuff I just didn't know then ;) Currently, it uses plain DBI and only supports MySQL, but I'm going to incorporate much from my other work whereby DBIx::Class is used (to more easily support multiple dbs), expand on the config file, the installer and the documentation. Is using RADIUS accounting stats for billing/logging even done anymore? Steve

4 10

Multiple Realms per NAS
by Nalin Mistry 06 Jan '10

06 Jan '10

We have just installed FreeRADIUS and have basic functionality working for ISP and Hotspot applications. For the ISP application, we would like to specify the realms supported on a NAS basis. Is this feasible and how would one go about configuring it. Thanks in advance...

2 1

Strange error log: NAS restarted
by Dinh Pham Cong 06 Jan '10

06 Jan '10

Hi all, I noticed that radius.log is filled with a lot of messages as follows: Wed Jan 6 10:54:35 2010 : Info: rlm_radutmp: NAS ggsn-add1 restarted (Accounting-On packet seen) Wed Jan 6 10:54:35 2010 : Error: rlm_radutmp: Error accessing file /srv/radius/var/log/radius/radutmp: No such file or directory Wed Jan 6 10:55:35 2010 : Info: rlm_radutmp: NAS ggsn-add1 restarted (Accounting-On packet seen) Wed Jan 6 10:55:35 2010 : Error: rlm_radutmp: Error accessing file /srv/radius/var/log/radius/radutmp: No such file or directory Wed Jan 6 10:55:35 2010 : Info: rlm_radutmp: NAS ggsn-add1 restarted (Accounting-On packet seen) Wed Jan 6 10:55:35 2010 : Error: rlm_radutmp: Error accessing file /srv/radius/var/log/radius/radutmp: No such file or directory Wed Jan 6 10:56:35 2010 : Info: rlm_radutmp: NAS ggsn-add1 restarted (Accounting-On packet seen) Wed Jan 6 10:56:35 2010 : Error: rlm_radutmp: Error accessing file /srv/radius/var/log/radius/radutmp: No such file or directory Wed Jan 6 10:56:36 2010 : Info: rlm_radutmp: NAS ggsn-add1 restarted (Accounting-On packet seen) Wed Jan 6 10:56:36 2010 : Error: rlm_radutmp: Error accessing file /srv/radius/var/log/radius/radutmp: No such file or directory Wed Jan 6 10:57:35 2010 : Info: rlm_radutmp: NAS ggsn-add1 restarted (Accounting-On packet seen) Wed Jan 6 10:57:35 2010 : Error: rlm_radutmp: Error accessing file /srv/radius/var/log/radius/radutmp: No such file or directory Wed Jan 6 10:57:36 2010 : Info: rlm_radutmp: NAS ggsn-add1 restarted (Accounting-On packet seen) Wed Jan 6 10:57:36 2010 : Error: rlm_radutmp: Error accessing file /srv/radius/var/log/radius/radutmp: No such file or directory Wed Jan 6 10:58:35 2010 : Info: rlm_radutmp: NAS ggsn-add1 restarted (Accounting-On packet seen) Wed Jan 6 10:58:35 2010 : Error: rlm_radutmp: Error accessing file /srv/radius/var/log/radius/radutmp: No such file or directory Wed Jan 6 10:58:36 2010 : Info: rlm_radutmp: NAS ggsn-add1 restarted (Accounting-On packet seen) Wed Jan 6 10:58:36 2010 : Error: rlm_radutmp: Error accessing file /srv/radius/var/log/radius/radutmp: No such file or directory Wed Jan 6 10:58:56 2010 : Error: [sql] stop packet with zero session length. [ip '10.136.0.13', nas '10.0.40.154'] Wed Jan 6 10:59:02 2010 : Error: [sql] stop packet with zero session length. [ip '10.136.0.13', nas '10.0.40.154'] Wed Jan 6 10:59:35 2010 : Info: rlm_radutmp: NAS ggsn-add1 restarted (Accounting-On packet seen) Wed Jan 6 10:59:35 2010 : Error: rlm_radutmp: Error accessing file /srv/radius/var/log/radius/radutmp: No such file or directory Wed Jan 6 10:59:36 2010 : Info: rlm_radutmp: NAS ggsn-add1 restarted (Accounting-On packet seen) Wed Jan 6 10:59:36 2010 : Error: rlm_radutmp: Error accessing file /srv/radius/var/log/radius/radutmp: No such file or directory Wed Jan 6 11:00:05 2010 : Error: [sql] stop packet with zero session length. [ip '10.136.0.5', nas '10.0.40.153'] Wed Jan 6 11:00:11 2010 : Error: [sql] stop packet with zero session length. [ip '10.136.0.5', nas '10.0.40.153'] Wed Jan 6 11:00:35 2010 : Info: rlm_radutmp: NAS ggsn-add1 restarted (Accounting-On packet seen) Wed Jan 6 11:00:35 2010 : Error: rlm_radutmp: Error accessing file /srv/radius/var/log/radius/radutmp: No such file or directory Wed Jan 6 11:00:36 2010 : Info: rlm_radutmp: NAS ggsn-add1 restarted (Accounting-On packet seen) Wed Jan 6 11:00:36 2010 : Error: rlm_radutmp: Error accessing file /srv/radius/var/log/radius/radutmp: No such file or directory The message "Info: rlm_radutmp: NAS ggsn-add1 restarted (Accounting-On packet seen)" has been repeating for several hours Could you kindly point me the right direction? Regards, Dinh

3 4

Re: Reject Calling-Station-Id
by Neville 05 Jan '10

05 Jan '10

> From: Arran Cudbard-Bell <arran.cudbard-bell(a)hp.com> > Subject: Re: Reject Calling-Station-Id >> if (Calling-Station-Id == "%{sql: SELECT mac FROM `lrc_banlist` WHERE >> mac='%{Calling-Station-Id}'}") { >> >> >> update reply { >> Reply-Message = "Hello Hello Hello" >> } >> reject >> } >> >> Read Uncle Alan has replied this. > > To save the followup exchange: > > update reply { > Reply-Message := "Hello Hello Hello" > } > > Uncle Alan?... > > -Arran Spot on Arran, thanks so much. Nev

1 0

compile pam_radius_auth.so on AIX 5.3
by Urs Golla 05 Jan '10

05 Jan '10

Hi Could someone already compile pam_radius_auth.so (1.3.17 or any other version) on AIX 5? I could compile the module but pam seems to ignore it completely. Other pam modules are working fine together with sshd. pam.conf: (...) sshd account sufficient /usr/lib/security/pam_radius_auth.so debug (...) /etc/raddb/server: (...) myserver:myport mysecret 3 Kind Regards

1 0

Reject Calling-Station-Id
by Neville 05 Jan '10

05 Jan '10

First, please let me wish everyone a Happy New Year in the list. I've learned a lot in the past 12 months and have a fairly stable installation of 2.1.6 on CentOS 5.4. The question, I would like to ask is how can I improve on this and use a DB List/Table to Blacklist certain IP addresses. if(Calling-Station-Id == 218.18.XX.XX){ reject } if(Calling-Station-Id == 113.237.XX.XX){ reject } The reason I'm having to do this is that we offer a 1hr Free Trial of our services and use the Email Address and IP address at the point of registration to ensure that the same person does not keep requesting more and more free trials. Obviously this not perfect and manages to address most of our requirements. However, there are a view people out there, that registered with a spoof IP Address and another free hotmail account etc, thus getting another Free Trial over and over again. The way I'm stop this currently, is manually check the record we had at the point of request for the Free Trial, and the IP address used to access the Service, if these are different then I block the IP address using the unlang above. There is only a few currently, but should this increase and I would like a more fool proof way to manage this and register the fact that someone has abused our free trial service and BLOCK there IP from accessing our service, even if they have been given a Username/Password via the Free Trial Page. Thanks in advance, Nev

3 2