- Freeradius-Users - lists.freeradius.org

Error: rlm_radutmp
by Wagner Pereira 27 Nov '09

27 Nov '09

Hi, folks. I'm trying to authenticate in a freeradius server, installed on a Debian 5.0 lenny x86_64. The freeradius version is 2.0.4 That is the message logged in my radius.log : Fri Nov 27 11:52:13 2009 : Error: rlm_radutmp: Logout for NAS cisco6500 port 0, but no Login record And my authentication method is the Debian /passwd one. Simple like that. Thanks a lot for some attention in this case. -- Wagner Pereira PoP-SP/RNP - Ponto de Presença da RNP em São Paulo CCE/USP - Centro de Computação Eletrônica da Universidade de São Paulo http://www.pop-sp.rnp.br Fone@RNP 1015-8902

2 9

LDAP auth in two sources
by Vladimir Mendelevich 27 Nov '09

27 Nov '09

Hello! radiusd: FreeRADIUS Version 1.1.3, for host x86_64-redhat-linux-gnu, built on Apr 25 2007 at 09:04:23 I need to make an authorization of some RADIUS clients in LDAP by RADIUS. Clients need only to check passwords. I can check this in ONE LDAP server at a time without problems. It's work fine. But i need some different. I need to check user/password in TWO different LDAP server. If ANY of LDAPs tell "password is ok" RADIUS must accept this userid/passwd pair. Userlists in this two LDAP have some overlap. Most (but not all) of the users presents in BOTH of LDAP servers. Passwords between LDAP servers are different. With curent configuration i get this: if username aren't found in first LDAP lets proceed to the next if username aren't found in second LDAP lets DENY access if username is found in first LDAP and password is accepted by first LDAP lets ALLOW access. if username is found in first LDAP and password aren't accepted by first LDAP lets DENY access. RADIUS doesn't check password in the second LDAP server. I know why but i doesn't know how to change this behavior. this is how looks users: --- LDAP1: uid=userid,o=org1 LDAP2: uid=userid,o=org2 --- As you can see organization is different in this two LDAP servers. I check this with "radtest" utility. /etc/raddb/radiusd.conf ------------------ modules { ldap tam { server = "ldap1.ts" basedn = "o=org1" filter = "(uid=%{User-Name})" authtype = tam start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 compare_check_items = no do_xlat = no access_attr_used_for_allow = no set_auth_type = yes } ldap lotus { server = "ldap2.ts" basedn = "o=org2" filter = "(uid=%{User-Name})" authtype = lotus start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 compare_check_items = no do_xlat = no access_attr_used_for_allow = no set_auth_type = yes } radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 #suppress { # User-Password #} } } authorize { group ldap { tam { notfound = 1 noop= 2 fail = 3 reject = 4 ok = return } lotus { notfound = 1 noop= 2 fail = 3 reject = 4 ok = return } handled } } authenticate { Auth-Type tam { tam { notfound = 1 noop= 2 fail = 3 reject = 4 ok = return } handled } Auth-Type lotus { lotus { notfound = 1 noop= 2 fail = 3 reject = 4 ok = return } handled } } -------------------------- logfiles: user exist in LDAP1 and password is good in LDAP1 --- rad_recv: Access-Request packet from host 192.168.110.3:49867, id=21, length=64 User-Name = "vmendelevich" User-Password = "11111111" NAS-IP-Address = 192.168.110.3 NAS-Port = 10 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall: entering group ldap for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for vmendelevich radius_xlat: '(uid=vmendelevich)' radius_xlat: 'o=org1' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap1.ts:389, authentication 0 rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow rlm_ldap: bind as / to ldap1.kmz.ts:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in o=org1, with filter (uid=vmendelevich) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Setting Auth-Type = tam rlm_ldap: user vmendelevich authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "tam" returns ok for request 0 modcall: leaving group ldap (returns ok) for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type tam auth: type "tam" Processing the authenticate section of radiusd.conf modcall: entering group tam for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "vmendelevich" with password "11111111" rlm_ldap: user DN: uid=vmendelevich,o=org1 rlm_ldap: (re)connect to ldap1.ts:389, authentication 1 rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow rlm_ldap: bind as uid=vmendelevich,o=org1/11111111 to ldap1.ts:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user vmendelevich authenticated succesfully modcall[authenticate]: module "tam" returns ok for request 0 modcall: leaving group tam (returns ok) for request 0 Login OK: [vmendelevich] (from client VMendelevich port 10) Sending Access-Accept of id 21 to 192.168.110.3 port 49867 Finished request 0 Going to the next request ---- user doesn't exist in LDAP1, but exist in LDAP2 and password is good in LDAP2 --- rad_recv: Access-Request packet from host 192.168.110.3:44439, id=108, length=57 User-Name = "aldap" User-Password = "22222222" NAS-IP-Address = 192.168.110.3 NAS-Port = 10 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall: entering group ldap for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for aldap radius_xlat: '(uid=aldap)' radius_xlat: 'o=tamknown' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=org1, with filter (uid=aldap) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "tam" returns notfound for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for aldap radius_xlat: '(uid=aldap)' radius_xlat: 'o=org2' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap2.ts:389, authentication 0 rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow rlm_ldap: bind as cn=admin ldap,o=org2/22222222 to ldap2.ts:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in o=org2, with filter (uid=aldap) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Setting Auth-Type = lotus rlm_ldap: user aldap authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "lotus" returns ok for request 1 modcall: leaving group ldap (returns ok) for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type lotus auth: type "lotus" Processing the authenticate section of radiusd.conf modcall: entering group lotus for request 1 rlm_ldap: - authenticate rlm_ldap: login attempt by "aldap" with password "22222222" rlm_ldap: user DN: CN=Admin LDAP,O=org2 rlm_ldap: (re)connect to ldap2.ts:389, authentication 1 rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow rlm_ldap: bind as CN=Admin LDAP,O=org2/22222222 to ldap2.ts:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user aldap authenticated succesfully modcall[authenticate]: module "lotus" returns ok for request 1 modcall: leaving group lotus (returns ok) for request 1 Login OK: [aldap] (from client VMendelevich port 10) Sending Access-Accept of id 108 to 192.168.110.3 port 44439 Finished request 1 Going to the next request --- username exist in BOTH LDAP but password can be accepted only by LDAP2 --- rad_recv: Access-Request packet from host 192.168.110.3:55540, id=92, length=64 User-Name = "vmendelevich" User-Password = "33333333" NAS-IP-Address = 192.168.110.3 NAS-Port = 10 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall: entering group ldap for request 2 rlm_ldap: - authorize rlm_ldap: performing user authorization for vmendelevich radius_xlat: '(uid=vmendelevich)' radius_xlat: 'o=org1' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=org1, with filter (uid=vmendelevich) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Setting Auth-Type = tam rlm_ldap: user vmendelevich authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "tam" returns ok for request 2 modcall: leaving group ldap (returns ok) for request 2 modcall: leaving group authorize (returns ok) for request 2 rad_check_password: Found Auth-Type tam auth: type "tam" Processing the authenticate section of radiusd.conf modcall: entering group tam for request 2 rlm_ldap: - authenticate rlm_ldap: login attempt by "vmendelevich" with password "33333333" rlm_ldap: user DN: uid=vmendelevich,o=org1 rlm_ldap: (re)connect to ldap1.ts:389, authentication 1 rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow rlm_ldap: bind as uid=vmendelevich,o=org1/33333333 to ldap1.ts:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind failed with invalid credentials modcall[authenticate]: module "tam" returns reject for request 2 modcall[authenticate]: module "handled" returns handled for request 2 modcall: leaving group tam (returns handled) for request 2 There was no response configured: rejecting request 2 Server rejecting request 2. Finished request 2 Going to the next request --- As i see i need to make something like "group" in authentication section. But i don't see how. Please advice. Thank you. UIN:9244669 Phone:+7(495)727-0982 ext.4162

2 7

How to find EAP session Id in Freeradius.
by shivashankar 27 Nov '09

27 Nov '09

hi, i am using freeradius 1.1.7 and Fedora How to find EAP session Id in Freeradius. plz help me plz find the error log Thu Nov 26 23:03:14 2009 : Debug: rlm_eap: EAP packet type response id 76 length 6 Thu Nov 26 23:03:14 2009 : Debug: rlm_eap: No EAP Start, assuming it's an on-going EAP conversation Thu Nov 26 23:03:14 2009 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 29 Thu Nov 26 23:03:14 2009 : Debug: modcall[authorize]: module "eap" returns updated for request 29 Thu Nov 26 23:03:14 2009 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 29 -- View this message in context: http://old.nabble.com/How-to-find-EAP-session-Id-in-Freeradius.-tp26540587p… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

home server debugging issues
by Josip Rodin 27 Nov '09

27 Nov '09

Hi, I upgraded one of our proxy servers from 2.0.4 to 2.1.7, and noticed that the proxying changed in a way that "status_check = request" logic started being critical, so this kind of stuff: Sun Nov 22 09:25:56 2009 : Error: Rejecting request 70011 due to lack of any response from home server X port 1812 ...was replaced, without a change in home server configuration, with: Tue Nov 24 06:32:01 2009 : Error: PROXY: Marking home server X port 1812 as zombie (it looks like it is dead). Tue Nov 24 06:32:03 2009 : Info: PROXY: Marking home server X port 1812 as dead. Tue Nov 24 06:32:03 2009 : Error: PROXY: Marking home server Y port 1812 as zombie (it looks like it is dead). Once this happened, I went to investigate, only to find out that our test username requests were no longer summarily rejected by those two home servers - instead they were discarded. So the marking those servers alive would never happen, and this was the obvious root of the proxying problem. It was unclear to me why didn't FreeRADIUS notice this as soon as it first happened, and when it eventually happened, why didn't it explicate the rationale. So I looked and found these in src/main/event.c: RDEBUG2("No response to status check %d from home server %s port %d", RDEBUG2("Proxying request %d to home server %s port %d", RDEBUG2("ERROR: Failed to find live home server for realm %s", RDEBUG2("Failed to find live home server for request %d", request->number); It doesn't make sense for both error and debug messages to be displayed on the same debug level. The error messages need to have priority, so that the admin actually has a chance to see them. In this particular situation, when I move from debug level 0 to 2 in order to oversee these events, I get not only these messages, but gobs of rlm_sql expansions, unlang processing logs, etc. It would be better if some of those error messages were upgraded to L_ERR, or L_PROXY, while keeping the truely informational messages as L_DBG. In fact it looks like there's only a single reference to L_PROXY in the entire file. Does this make sense, can I submit patches? -- 2. That which causes joy or happiness.

2 10

ntlm_auth and Server 2008 R2 (or, how to select a group for a proxied request)
by Meyers, Dan 27 Nov '09

27 Nov '09

Info (For the short version of what I need, skip to the last paragraph): For a while now we've been running a stable solution for our wireless system 802.1x auth involving FreeRADIUS. Specifically, when a client tries to do a PEAP/MSCHAPv2 auth the eap module of FreeRADIUS successfully negotiates and terminates the EAP tunnel, and the MSCHAPv2 data is extracted and then shelled out to ntlm_auth which talks to our domain controllers (Windows Server 2003) to verify whether the MSCHAPv2 encoded password is correct for the given username. This worked fine, right up until we upgraded our domain controllers to Windows Server 2008 R2. Suddenly, ntlm_auth stopped talking to the DC. The message we were getting back when we tried to auth (either via radius or on the command line with a simple ntlm_auth --username=<username> and then specifying the password at the prompt) was NT_STATUS_PIPE_DISCONNECTED: Named pipe dicconnected (0xc00000b0). wbinfo -u successfully gets a list of every user the DCs know about, so we can still talk to them (This is on Samba 3.4.0, the latest on Ubuntu Server 9.10). As we couldn't seem to talk to the DC directly, we instead proxied to a Windows Server 2003 RADIUS server which was on the domain, which then terminated the EAP tunnel and queried the DC for the info we needed. We'd rather not need this step, but it got around the ntlm_auth issues we were having. The problem now, is that our authorize section in our inner-tunnel (used when there is a PEAP connection) used the sql module to extract group information from the user group table of the radius postgres database. Thus we could return a radius key:value pair that would dump a user into a group based on the returned result of the group_membership_query. As we are now proxying the request instead of doing authorize ourselves, this query is not getting run and every single user is ending up in the default group. 'sql' as a module can't go into post-proxy, so i'm unsure how to get this query to be run once the Windows server has returned OK for a request. The Windows RADIUS server does not seem to have enough functionality to get the group information we require. So, I either need to work out what to do to ntlm_auth to make it play nicely with Server 2008 R2 domain controllers for user verification, or I need to work out how to get FreeRADIUS to do the group sql query and add the relevant pairs before returning the result to the client after it has got an Access-Accept from the Windows RADIUS server for the request it proxied there. Has anyone got any experience of either of these things? Thanks in advance Dan

3 2

Re: Acct-Unique-Session-Id not unique
by Vega Freeradius 26 Nov '09

26 Nov '09

Alan DeKok on Thu, 26 Nov 2009 09:08:37 -0800 Wrote: > Odds are because the Client-IP-Address is different. Everything else >in the packet looks to be the same. You are right!!! It 'was my mistake. It said "Client-IP-Address" but I was reading "Framed-IP-Address" and did not understand why hash come out different! I don't need debug :) Thank you!! Marco

1 0

Process radiusd won't start after installation (Solaris 10)
by Nereida Bernal 26 Nov '09

26 Nov '09

SO: Solaris 10 Version: 2.1.7 Hi all! I installed freeradius on my server following the instructions in the INSTALL file. After the "make install" I tried to start the radiusd process in debug mode but I got the following error: bash-3.00# /usr/local/sbin/radiusd -X ld.so.1: radiusd: fatal: libgcc_s.so.1: open failed: No such file or directory Killed I looked for the missing file in the server but none of them worked bash-3.00# find / -name libgcc_s.so.1 /usr/lib/AdobeReader/Adobe/Reader8/Reader/sparcsolaris/lib/libgcc_s.so.1 /usr/sfw/lib/sparcv9/libgcc_s.so.1 /usr/sfw/lib/libgcc_s.so.1 /usr/local/lib/libgcc_s.so.1 /usr/local/lib/sparcv9/libgcc_s.so.1 If you need the installation logs please let me know, I am new with the freeRADIUS I hope you can help me with this. Regards

1 1

Unexpected "Exiting normally" 2.1.8?
by Craig Campbell 26 Nov '09

26 Nov '09

I'm running an unreleased '"development?" version of freeradius (2.1.8?). So far it is working well, but it is terminating for reasons I cannot determine. The log contains the following, Mon Oct 26 15:48:57 2009 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Mon Oct 26 15:48:57 2009 : Info: rlm_sql (sql): Attempting to connect to radiusd@localhost:/radius Mon Oct 26 15:48:57 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Mon Oct 26 15:48:57 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Mon Oct 26 15:48:57 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Mon Oct 26 15:48:57 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Mon Oct 26 15:48:57 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Mon Oct 26 15:48:57 2009 : Info: Loaded virtual server inner-tunnel Mon Oct 26 15:48:57 2009 : Info: Loaded virtual server copy-acct-to-home-server Mon Oct 26 15:48:57 2009 : Info: Loaded virtual server copy-acct-to-radius-c Mon Oct 26 15:48:57 2009 : Info: Loaded virtual server <default> Mon Oct 26 15:48:57 2009 : Info: Ready to process requests. Mon Oct 26 17:57:33 2009 : Error: PROXY: Marking home server 192.168.1.226 port 1813 as zombie (it looks like it is dead). Mon Oct 26 17:58:13 2009 : Info: PROXY: Marking home server 192.168.1.226 port 1813 as dead. Mon Oct 26 20:05:36 2009 : Info: Exiting normally. The zombie messages are suspicious, since neither host is experiencing any significant load. (The zombie server is also 2.1.8. There is a 2.1.7 server as well NOT being zombied..) The exit message is much later, but no hint as to WHY it is exiting normally. Any hints would be greatly appreciated. Thanks, -craig -------------------------------------------------------------------------------- Craig Campbell craig.campbell(a)ccraft.ca CampbellCraft Consulting Inc 2 Kenny Court Whitby, Ontario Canada L1R 2L8 905 922-2789 __________ Information from ESET Smart Security, version of virus signature database 4546 (20091027) __________ The message was checked by ESET Smart Security. http://www.eset.com

4 40

Force CA validation
by Fernando Calvelo Vazquez 26 Nov '09

26 Nov '09

How can I force the CA validation on a EAP-TTLS configuration. If in my Windows-Supplicant software I select the CA validation, it works. But if remove it, and I use only the User-Credentials Authentication part... it works also. I would like to force that the CA certification Authentication part must be mandatory also. (I'm using windows-supplicant software with EAP-TTLS method) Thanks in advance, Swatzy.

4 3

Re: Exec and ntlm_auth
by freeradius＠corwyn.net 26 Nov '09

26 Nov '09

At 02:54 PM 11/25/2009, you wrote: >Just make it anothe file in the modules directory (like all the others). >Any file placed in that directory is authomatically included as a module. Can you provide an example of that file? Also, on the web page for AD config it has: ntlm_auth = "/path/to/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{mschap:NT-Domain:-MYDOMAIN} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" the "-" is bolded in the NT-Domain such that it indicates that it should be replaced, but should it be --domain=%{mschap:NT-Domain:example.com} or --domain=%{mschap:NT-Domain:-example.com} Rick

5 8