- Freeradius-Users - lists.freeradius.org

DHCP routing bug (FreeRadius DHCP reply to Default Gateway)
by Pavel Malev 29 Sep '09

29 Sep '09

Hello! I have Freeradius 2.1.6 on freebsd6.2. Freebsd have Default Gateway: Destination Gateway Flags Refs Use Netif Expire default 192.168.2.150 UGS 0 7922 rl1 Default Gateway have mac-address: ? (192.168.2.150) at 00:30:48:35:31:32 on rl1 [ethernet] Freeradius receive DHCP-Discover: [tcpdump] 02:28:25.754215 00:0c:f1:4e:42:36 > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 348: 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:0c:f1:4e:42:36, length: 306 After authorization Freeradius send reply to Default Gateway(!), not to clinet: [tcpdump] 02:28:25.766341 00:30:4f:21:b4:73 > 00:30:48:35:31:32, ethertype IPv4 (0x0800), length 342: 192.168.2.252.67 > 255.255.255.255.68: BOOTP/DHCP, Reply, length: 300 If I delete Default Gateway - FreeRadius dont send anything. If I put "interface = rl1" in the listen{} section, I get error: /usr/local/etc/raddb/radiusd.conf[56]: System does not support binding to interfaces. Delete this line from the configuration file. FreeRadiusd debug messages: Received DHCP-Discover of id 2083766121 from 0.0.0.0:68 to 0.0.0.0:67 DHCP-Opcode = Client-Message DHCP-Hardware-Type = Ethernet DHCP-Hardware-Address-Length = 6 DHCP-Hop-Count = 0 DHCP-Transaction-Id = 2083766121 DHCP-Number-of-Seconds = 0 DHCP-Flags = 0 DHCP-Client-IP-Address = 0.0.0.0 DHCP-Your-IP-Address = 0.0.0.0 DHCP-Server-IP-Address = 0.0.0.0 DHCP-Gateway-IP-Address = 0.0.0.0 DHCP-Client-Hardware-Address = 00:0c:f1:4e:42:36 DHCP-Message-Type = DHCP-Discover DHCP-Auto-Config = 1 DHCP-Client-Identifier = 00:0c:f1:4e:42:36 DHCP-Requested-IP-Address = 169.254.184.172 DHCP-Hostname = "computer-4cacfb" DHCP-Vendor-Class-Identifier = "MSFT 5.0" DHCP-Parameter-Request-List = DHCP-Subnet-Mask DHCP-Parameter-Request-List = DHCP-Domain-Name DHCP-Parameter-Request-List = DHCP-Router-Address DHCP-Parameter-Request-List = DHCP-Domain-Name-Server DHCP-Parameter-Request-List = DHCP-NETBIOS-Name-Servers DHCP-Parameter-Request-List = DHCP-NETBIOS-Node-Type DHCP-Parameter-Request-List = DHCP-NETBIOS DHCP-Parameter-Request-List = DHCP-Perform-Router-Discovery DHCP-Parameter-Request-List = DHCP-Static-Routes DHCP-Parameter-Request-List = 249 DHCP-Parameter-Request-List = DHCP-Vendor DHCP-Vendor = 0xdc00 Trying sub-section dhcp DHCP-Discover {...} +- entering group DHCP-Discover {...} expand: %{Packet-Dst-IP-Address} -> 0.0.0.0 ++[reply] returns noop rlm_perl: mac: 00:0c:f1:4e:42:36 rlm_perl: DB result: 192.168.2.1 rlm_perl: Added pair DHCP-Your-IP-Address = 0.0.0.0 rlm_perl: Added pair DHCP-Message-Type = DHCP-Discover rlm_perl: Added pair DHCP-Vendor-Class-Identifier = MSFT 5.0 rlm_perl: Added pair DHCP-Hop-Count = 0 rlm_perl: Added pair DHCP-Number-of-Seconds = 0 rlm_perl: Added pair DHCP-Client-IP-Address = 0.0.0.0 rlm_perl: Added pair DHCP-Gateway-IP-Address = 0.0.0.0 rlm_perl: Added pair DHCP-Hardware-Type = Ethernet rlm_perl: Added pair DHCP-Flags = 0 rlm_perl: Added pair DHCP-Hardware-Address-Length = 6 rlm_perl: Added pair DHCP-Hostname = computer-4cacfb rlm_perl: Added pair DHCP-Opcode = Client-Message rlm_perl: Added pair DHCP-Transaction-Id = 2083766121 rlm_perl: Added pair DHCP-Parameter-Request-List = DHCP-Subnet-Mask rlm_perl: Added pair DHCP-Parameter-Request-List = DHCP-Domain-Name rlm_perl: Added pair DHCP-Parameter-Request-List = DHCP-Router-Address rlm_perl: Added pair DHCP-Parameter-Request-List = DHCP-Domain-Name-Server rlm_perl: Added pair DHCP-Parameter-Request-List = DHCP-NETBIOS-Name-Servers rlm_perl: Added pair DHCP-Parameter-Request-List = DHCP-NETBIOS-Node-Type rlm_perl: Added pair DHCP-Parameter-Request-List = DHCP-NETBIOS rlm_perl: Added pair DHCP-Parameter-Request-List = DHCP-Perform-Router-Discovery rlm_perl: Added pair DHCP-Parameter-Request-List = DHCP-Static-Routes rlm_perl: Added pair DHCP-Parameter-Request-List = 249 rlm_perl: Added pair DHCP-Parameter-Request-List = DHCP-Vendor rlm_perl: Added pair DHCP-Client-Hardware-Address = 00:0c:f1:4e:42:36 rlm_perl: Added pair DHCP-Server-IP-Address = 0.0.0.0 rlm_perl: Added pair DHCP-Requested-IP-Address = 169.254.184.172 rlm_perl: Added pair DHCP-Auto-Config = 1 rlm_perl: Added pair DHCP-Vendor = 0xdc00 rlm_perl: Added pair DHCP-Client-Identifier = 00:0c:f1:4e:42:36 rlm_perl: Added pair DHCP-Your-IP-Address = 192.168.2.1 rlm_perl: Added pair DHCP-DHCP-Server-Identifier = 192.168.2.252 rlm_perl: Added pair DHCP-Subnet-Mask = 255.255.255.0 rlm_perl: Added pair DHCP-Gateway-IP-Address = 192.168.2.150 rlm_perl: Added pair DHCP-IP-Address-Lease-Time = 86400 rlm_perl: Added pair DHCP-Router-Address = 192.168.2.150 ++[perl] returns ok ++? if (ok) ? Evaluating (ok) -> TRUE ++? if (ok) -> TRUE ++- entering if (ok) {...} +++[reply] returns ok ++- if (ok) returns ok ++ ... skipping else for request 0: Preceding "if" was taken ++[ok] returns ok Sending -1022 of id 2083766121 from 0.0.0.0:67 to 0.0.0.0:68 DHCP-Opcode = Server-Message DHCP-Hardware-Type = Ethernet DHCP-Hardware-Address-Length = 6 DHCP-Hop-Count = 0 DHCP-Transaction-Id = 2083766121 DHCP-Number-of-Seconds = 0 DHCP-Flags = 0 DHCP-Client-IP-Address = 0.0.0.0 DHCP-Your-IP-Address = 192.168.2.1 DHCP-Server-IP-Address = 0.0.0.0 DHCP-Gateway-IP-Address = 0.0.0.0 DHCP-Client-Hardware-Address = 00:0c:f1:4e:42:36 DHCP-Server-Host-Name = "" DHCP-Boot-Filename = "" DHCP-Subnet-Mask = 255.255.255.0 DHCP-Router-Address = 192.168.2.150 DHCP-NTP-Servers = 192.168.2.150 DHCP-IP-Address-Lease-Time = 86400 DHCP-DHCP-Server-Identifier = 192.168.2.252 Finished request 0. Cleaning up request 0 ID 2083766121 with timestamp +18 Going to the next request Ready to process requests. radiusd.conf: prefix = /usr/local exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = ${prefix}/var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct name = radiusd confdir = ${raddbdir} run_dir = ${localstatedir}/run/${name} db_dir = ${raddbdir} libdir = ${exec_prefix}/lib pidfile = ${run_dir}/${name}.pid max_request_time = 30 cleanup_delay = 5 max_requests = 1024 listen { ipaddr = * port = 67 type = dhcp # interface = rl1 } hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log { <skiped> } checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = yes } proxy_requests = no thread pool { <skiped> } client any { ipaddr = 0.0.0.0 netmask = 0 dhcp = yes } dhcp DHCP-Discover { update reply { DHCP-DHCP-Server-Identifier = "%{Packet-Dst-IP-Address}" } perl if (ok) { update reply { DHCP-Message-Type = DHCP-Offer DHCP-NTP-Servers = 193.111.126.2 } } else { update reply { DHCP-Message-Type = 0 } } ok } dhcp DHCP-Request { update reply { DHCP-DHCP-Server-Identifier = "%{Packet-Dst-IP-Address}" } perl if (ok) { update reply { DHCP-Message-Type = DHCP-ACK DHCP-NTP-Servers = 1.1.1.1 } } elsif (notfound) { update reply { DHCP-Message-Type = DHCP-NAK } } else { update reply { DHCP-Message-Type = 0 } } linelog ok } dhcp DHCP-Release { handled } dhcp DHCP-Inform { handled } dhcp { handled } modules { perl { module = ${raddbdir}/check.pl } $INCLUDE ${confdir}/modules/ } Is it possible to fix? Thank you, sorry for my English. Best regards, Pavel Malev

2 1

New install does not respond to requests
by Alex M 29 Sep '09

29 Sep '09

hey all we just upgraded from 1.x.x to latest version of FreeRadius unfortunately its aint working :( well i see config files have changed dramatically so maybe i did something wrong. What we did we installed everything, unquoted SQL module in dadiusd.config add proper MySQL info When i start in -X mode i don't see any errors but the half of the log is cut off (i guess output is too long) When I send request i'm getting response that client is unknown. (I did add nas info in the nas table) I fugue that SQL statements are not executed but how can i debug that? In sql config i enabled detailed output but it still does not show anything. I guess i'm doing something wrong and I hope i can get some help here? Thanks a lot!

4 5

Configuration of FreeRADIUS on Ubuntu/Debian with OPEN-LDAP Authentication
by Ryaz Khan 28 Sep '09

28 Sep '09

Hello everyone, I am the new member of this list, I just joined today and this is my first question so please ignore any unknown mistake(s) ! I have *Ubuntu Server edition 8.04.3* configured with samba with * open-ldap(slapd)* authentication which works pretty well I also installed *FreeRADIUS 2.1.7*, I was able to configure it but very basic like I am using users file for user names and passwords etc. Now I am trying to setup freeradius for ldap authentication so I dont have to add separate users in users file but can use ldap users instead, for Free-radius authentication I am a student so just want to do it for learning purposes. I would appreciate if someone can help me with that or can direct me to the right directions, howtos etc.. I googled it lot but did not come to any comprehensive solution. Thanks guys -- Ryaz Khan

3 2

Re: Start Freeradius at boot
by Paul.Blalock＠gmail.com 28 Sep '09

28 Sep '09

did you install FreeRADIUS via yum and a repository or from source? > Downloaded freeradius-server-2.1.7.tar.gz, extracted to home directory, > and then ./configure, make, make install. if from the repsository you should have a selectable service with eg the standard Fedora system startup tools - maybe they've decided to call it 'freeradius' or 'freeradius2' rather than radiusd? > There is a "Startup Applications" where I can add programs, but it > doesn't start > them until you log on to the machine and this doesn't work unless you log > into > the gui as root. if from source, then the install part (make install) wont handle your OS directory - you'll need to copy the script (and maybe edit it according to install path choices made) from the contrib directory eg redhat/rc.radiusd-redhat to the correct place - /etc/init.d/ i'd note now that its not just the startup item - theres also a logrotate script which ties into the system logrotate cron stuff to ensure that freeradius logs (eg /var/log/radius/ get rotated when needed - eg each day for 90 days retention) alan

3 2

Reminder: Webinar with FreeRADIUS and MySQL: Sept. 30
by Alan DeKok 28 Sep '09

28 Sep '09

I will be giving a Webinar with MySQL on September 30. Registration is available at: http://www.mysql.com/news-and-events/web-seminars/display-419.html The webinar will be given via Webex. You will need an account on mysql.com in order to register and see webex details. The full announcement is below. Alan DeKok. +++++++++++++++++++++++++++++++++++++++++++++++++++++++ FreeRADIUS & MySQL Cluster: Scalable and Highly Available AAA Services Wednesday, September 30, 2009 As network use grows and services become more dynamic, so existing Authentication, Authorization and Accounting (AAA) environments can struggle to keep pace with demand Tune into this webinar where you can hear from the Alan DeKok, one of the founders of the FreeRADIUS project and CEO of Network RADIUS, discuss the concepts and implementation of RADIUS services using the FreeRADIUS server and the MySQL Cluster database to deliver highly available and scalable AAA services In this session, you will learn about: - potential AAA limitations as network environments grow - advantages of deploying FreeRADIUS with MySQL Cluster - Performance, sizing and deployment of an AAA environment using FreeRADIUS with MySQL Cluster - customer case studies - how to get started WHO: * Alan DeKok, Founder of FreeRADIUS and CEO of Network RADIUS * Matthew Keep, MySQL Cluster Product Management WHAT: FreeRADIUS & MySQL Cluster: Scalable and Highly Available AAA Services WHEN: Wednesday, September 30, 2009: 09:30 Pacific time (America) 06:30 Hawaii time 10:30 Mountain time (America) 11:30 Central time (America) 12:30 Eastern time (America) 16:30 UTC 17:30 Western European time 18:30 Central European time 19:30 Eastern European time The presentation will be approximately 45 minutes long followed by Q&A. WHERE: Simply access the web seminar from the comfort of your own office. WHY: To learn more about how you can use FreeRADIUS and MySQL Cluster 7.0 to deliver highly available and scalable AAA Services

1 0

Build failure on arch Linux
by Leighton Man 28 Sep '09

28 Sep '09

Hi, Foolishly, I said earlier today, that building on Linux should be a breeze. I should have kept quiet!! I downloaded 2.1.7 and it failed to build rlm_krb5 with messages about structure members. I reran configure with --without-rlm-krb5 and got: In function 'setup_modules': undefined ref to lt__PROGRAM__LTX_preloaded_symbols in src/main/modules.c. I notice in the bug fixes for 2.1.7 there's a workaround added. Seems it doesn't work for me. Any suggestions please. Leighton --- This transmission is confidential and may be legally privileged. If you receive it in error, please notify us immediately by e-mail and remove it from your system. If the content of this e-mail does not relate to the business of the University of Huddersfield, then we do not endorse it and will accept no liability.

4 5

Re: Start Freeradius at boot
by Paul.Blalock＠gmail.com 28 Sep '09

28 Sep '09

Hi, > I am trying to get freeradius to start at boot time so that I don't have > to log in for it to start up. I saw a previous post that said to > “Manually add the links in /etc/rc[0-6].d.” > I am not sure what links this is referring to though, so I am at a > standstill as to how to do this. dpends on what OS you have - and, under Linux, which distro you have. if you have installed from a package, then that package should have supplied the required start/stop scripts for the system and then you can use the OS's chosen service solution to configure whether/when the service is started. if you have built from source, then there are a few scripts supplied in the source tarball that can be used - eg there is a script for RedHat - just copy that script into /etc/init.d and do a 'chkconfig radiusd on' alan Guess I did forget to include that. I am using Fedora 11, installed from CD, and when I do a 'chkconfig radiusd on', it says no such file or directory. Paul

2 1

Start Freeradius at boot
by Paul.Blalock＠gmail.com 28 Sep '09

28 Sep '09

I am trying to get freeradius to start at boot time so that I don't have to log in for it to start up. I saw a previous post that said to “Manually add the links in /etc/rc[0-6].d.” I am not sure what links this is referring to though, so I am at a standstill as to how to do this. Thanks Paul Blalock

2 1

Freeradius certificate not chain problem
by trevor obba 28 Sep '09

28 Sep '09

I am trying to in an install an SSL certificate issued by Janet on a freeradius (open source radius application). The installation and the configuration went fine however Microsoft windows vista and Apple Mac machines are prompting that the certificate is not chain. Here my TLS configuration in /etc/raddb/eap.conf private_key_password = uc123uc private_key_file = ${certdir}/jaguar.key certificate_file = ${certdir}/cert.pem CA_file = ${cadir}/sureserverEDU.pem The CA_file is pointing at the intermediate root certificate however windows vista and Apple Mac client are informing me that the certificate is not chained. I even tried concatenating all certificate in one file like: but no joy cat sureserverEDU.pem > mycert.pem cat cert.pem >> mycert.pem I also tried concatenating all certificate in one file like cat ct_root.der > mycert.pem cat sureserverEDU.pem >> mycert.pem cat cert.pem >> mycert.pem But this is not working either, Can you shad some light on this please? Thank again. Note ct_root.der is the GTE CyberTrust Global Root sureserverEDU.pem is the Cybertrust Educational CA cert.pem is my globalsign certificate

2 1

(no subject)
by Kamil Semavi 28 Sep '09

28 Sep '09

n Sep 28 05:01:23 2009 : Error: Dropping conflicting packet from client private-network-2:45456 - ID: 102 due to unfinished request 73062 Mon Sep 28 05:01:24 2009 : Error: Dropping conflicting packet from client private-network-2:46646 - ID: 6 due to unfinished request 73055 Mon Sep 28 05:01:24 2009 : Error: WARNING: Unresponsive child (id 2811198352) for request 73046 (in component accounting module rlm_sql) Mon Sep 28 05:01:24 2009 : Error: Dropping conflicting packet from client private-network-2:58451 - ID: 70 due to unfinished request 73070 Mon Sep 28 05:01:25 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Sep 28 05:01:25 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Sep 28 05:01:25 2009 : Error: Dropping conflicting packet from client private-network-2:57058 - ID: 8 due to unfinished request 73066 Mon Sep 28 05:01:26 2009 : Error: Dropping conflicting packet from client private-network-2:2059 - ID: 39 due to unfinished request 73067 Mon Sep 28 05:01:26 2009 : Error: WARNING: Unresponsive child (id 2863647632) for request 73047 (in component accounting module rlm_sql) Mon Sep 28 05:01:26 2009 : Error: Dropping conflicting packet from client private-network-2:58451 - ID: 70 due to unfinished request 73070 Mon Sep 28 05:01:27 2009 : Error: WARNING: Unresponsive child (id 2779728784) for request 73048 (in component accounting module rlm_sql) Mon Sep 28 05:01:27 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Sep 28 05:01:27 2009 : Error: Dropping conflicting packet from client private-network-2:1667 - ID: 193 due to unfinished request 73072 Mon Sep 28 05:01:28 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Sep 28 05:01:28 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Sep 28 05:01:28 2009 : Error: Discarding duplicate request from client private-network-2:34244 - ID: 112 due to unfinished request 73074 Mon Sep 28 05:01:28 2009 : Error: Dropping conflicting packet from client private-network-2:34244 - ID: 112 due to unfinished request 73074 Mon Sep 28 05:01:29 2009 : Error: Dropping conflicting packet from client private-network-2:1667 - ID: 193 due to unfinished request 73072 Mon Sep 28 05:01:29 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Sep 28 05:01:30 2009 : Error: Dropping conflicting packet from client private-network-2:60655 - ID: 71 due to unfinished request 73075 Mon Sep 28 05:01:31 2009 : Error: Dropping conflicting packet from client private-network-2:33747 - ID: 7 due to unfinished request 73058 Mon Sep 28 05:01:31 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Sep 28 05:01:32 2009 : Error: Dropping conflicting packet from client private-network-2:60655 - ID: 71 due to unfinished request 73075 Mon Sep 28 05:01:33 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Sep 28 05:01:33 2009 : Error: Dropping conflicting packet from client private-network-2:45456 - ID: 102 due to unfinished request 73062 Mon Sep 28 05:01:35 2009 : Error: Dropping conflicting packet from client private-network-2:3494 - ID: 92 due to unfinished request 73071 Mon Sep 28 05:01:35 2009 : Error: WARNING: Unresponsive child (id 3084983184) for request 73055 (in component accounting module rlm_sql) Mon Sep 28 05:01:35 2009 : Error: WARNING: Unresponsive child (id 2979036048) for request 73054 (in component accounting module rlm_sql) Mon Sep 28 05:01:35 2009 : Error: WARNING: Unresponsive child (id 2832178064) for request 73053 (in component accounting module rlm_sql) Mon Sep 28 05:01:35 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Sep 28 05:01:35 2009 : Error: Dropping conflicting packet from client private-network-2:57058 - ID: 8 due to unfinished request 73066 Mon Sep 28 05:01:36 2009 : Error: Dropping conflicting packet from client private-network-2:2059 - ID: 39 due to unfinished request 73067 Mon Sep 28 05:01:37 2009 : Error: Dropping conflicting packet from client private-network-2:36362 - ID: 9 due to unfinished request 73073 Mon Sep 28 05:01:37 2009 : Error: WARNING: Unresponsive child (id 2790218640) for request 73056 (in component accounting module rlm_sql) Mon Sep 28 05:01:37 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Sep 28 05:01:39 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Sep 28 05:01:39 2009 : Error: Dropping conflicting packet from client private-network-2:32873 - ID: 159 due to unfinished request 73080 Mon Sep 28 05:01:40 2009 : Error: Dropping conflicting packet from client private-network-2:56532 - ID: 120 due to unfinished request 73076 Mon Sep 28 05:01:41 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Sep 28 05:01:41 2009 : Error: WARNING: Unresponsive child (id 3062954896) for request 73058 (in component accounting module rlm_sql) Mon Sep 28 05:01:41 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Sep 28 05:01:41 2009 : Error: Dropping conflicting packet from client private-network-2:3211 - ID: 75 due to unfinished request 73081 Mon Sep 28 05:01:41 2009 : Error: Dropping conflicting packet from client private-network-2:32873 - ID: 159 due to unfinished request 73080 Mon Sep 28 05:01:42 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Sep 28 05:01:43 2009 : Error: Dropping conflicting packet from client private-network-2:3211 - ID: 75 due to unfinished request 73081 Mon Sep 28 05:01:43 2009 : Error: WARNING: Unresponsive child (id 3052465040) for request 73059 (in component accounting module rlm_sql) Mon Sep 28 05:01:43 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Why I am having this error messages? Here is my radiusd.conf Thanks. Kamil

4 8