- Freeradius-Users - lists.freeradius.org

mac-based authentification fail
by sserre 28 Apr '09

28 Apr '09

Hello gentlemen's, After one week search the web for a solution, i come to this maling list. I have to set up a mac-based authentication system (pretty simple) with HP procurve swtichs. I have see lot of tutorials, buy a book, download more, but it still don't work (access-request denied). I hope somebody can look at my basic problem a few minute. User is reconized (found at line X), but freeradius don't know how to interprete the password (I think). I have see that the CHAP-password attribute send by the client (HP Procurve 2800), is not the same heach time. Is it normal (I don't think). The switch look like he is well configured (running-config in attachement). In attachement, you will find initialisation of freeradius (radius_init), an acces-request from the client (acces-request), the entry of my test user (users), and the running config of the HP Procurve. I hope somebody know this problem. Kind regards Sébastien Serre -- Service informatique IBGC CNRS 1 rue Camille Saint Saens 33077 BORDEAUX CEDEX Tel. +33 (0)5 56 99 90 04 Fax. +33 (0)5 56 99 90 59 http://www.ibgc.cnrs.fr

3 3

RE: Adding vendor specefic attributes
by anoop c 28 Apr '09

28 Apr '09

Hi Thanks for the response. I am using free RADIUS version 1.1.7.I just require MAC authentication alone. Is anything wrong in the 'users' file NAS will support the VSA in this case. Vendor has given the following details Network Access Server Vendor- (Code for the specific vendor) Vendor Assigned Attribute number-1 (for Input/Uplink) 2 (for Output/Downlink) Attribute format decimal Attribute value-(Desired Input/Output bandwidth) How I can configure this attribte? Thanks and regards Anoop -----Original Message----- From: freeradius-users-bounces+anoop_c=sifycorp.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+anoop_c=sifycorp.com@lists.freeradius.org] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: Monday, April 27, 2009 10:57 PM To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 48, Issue 114 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: %RADIUS-4-RADIUS_ALIVE | %RADIUS-4-RADIUS_DEAD help (A.L.M.Buxey(a)lboro.ac.uk) 2. Re: [Wimax TTLS with Alcatel - Lucent ASN GW] (Ivan Kalik) 3. RE: Adding vendor specefic attributes (Ivan Kalik) 4. Re: %RADIUS-4-RADIUS_ALIVE | %RADIUS-4-RADIUS_DEAD help (Borislav Dimitrov) 5. freeradius with active directory (David N'DAKPAZE) 6. Re: radpostauth sql logging of bad passwords (Guy Fraser) 7. Re: freeradius with active directory (bastardinho69) 8. Re: radpostauth sql logging of bad passwords (Alan DeKok) ---------------------------------------------------------------------- Message: 1 Date: Mon, 27 Apr 2009 13:41:38 +0100 From: A.L.M.Buxey(a)lboro.ac.uk Subject: Re: %RADIUS-4-RADIUS_ALIVE | %RADIUS-4-RADIUS_DEAD help To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20090427124138.GC7926(a)lboro.ac.uk> Content-Type: text/plain; charset=us-ascii Hi, > Same box. and you do live accounting database insertions? This sounds to me very much like the classic 'tables have now grown just too big' - everything works fine then barfs one day. the request isnt getting serviced in time therefore its marking as dead..check your query times...remove wrong/unused indexes or move to 'out of band' accounting inserts - very easy with 2.1.x alan ------------------------------ Message: 2 Date: Mon, 27 Apr 2009 14:36:54 +0100 (BST) From: "Ivan Kalik" <tnt(a)kalik.net> Subject: Re: [Wimax TTLS with Alcatel - Lucent ASN GW] To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <57087.194.176.105.43.1240839414.squirrel(a)webmail.kalik.net> Content-Type: text/plain;charset=utf-8 > Anyway If I may reask a new question about adding multiple attribute to > reply on the radius that proxy. > > The solution you gave me, (eg use users file and match the Realm > Attribute, > DEFAULT Realm == whatever) is ok for a "ISP" radius (eg end radius), not > for a "Wholesale" radius (eg radius that proxy). > According to what I saw in debug, Realm attribute is only use in the > request (eg add by the proxy radius), but even if I force it in the reply > of the end radius, it won't be consider in the reply by the proxy radius. > > So that I can not add the wanted attribute as I would like too. > > For now what I do, is use the attrs file for first attribute, then use > unlang in post auth to add the second attribute. > Files module supports use of files in post-auth and post-proxy. Add this to raddb/modules/files: postproxy_usersfile = ${confdir}/postproxy_users Then create postproxy_users in raddb directory (where other users files are) and list that DEAFAULT entry there. Ivan Kalik Kalik Informatika ISP ------------------------------ Message: 3 Date: Mon, 27 Apr 2009 14:43:25 +0100 (BST) From: "Ivan Kalik" <tnt(a)kalik.net> Subject: RE: Adding vendor specefic attributes To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <64565.194.176.105.44.1240839805.squirrel(a)webmail.kalik.net> Content-Type: text/plain;charset=utf-8 > Is it possible to configure vendor specific attributes in Free RADIUS. > Please guide where can I edit the configuration. Nowhere. > I am using MAC authentication by editing the user file shown below. > > '020a6-5a7fd9 Auth-Type:=Local,User-Password=="secret" > There is so much wrong with this unless you are using a very, very, very old server version. > > MAC authentication is working and I would like to add a vendor specific > attribute. > You add vendor specific attributes - just like any other. Just make sure that you have the dictionary for that vendor in your installation (it's a text file share/dictionary.vendor_name) and that that dictionary contains attribute you want to use. Ivan Kalik Kalik Informatika ISP ------------------------------ Message: 4 Date: Mon, 27 Apr 2009 17:44:10 +0300 From: Borislav Dimitrov <b.dimitrov(a)ngsystems.net> Subject: Re: %RADIUS-4-RADIUS_ALIVE | %RADIUS-4-RADIUS_DEAD help To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <618820F7-3340-4483-BEBB-7937BB8B5C62(a)ngsystems.net> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Hi, As far as I can see, the people on the list have provided you with a lot of very useful suggestions on what could cause the problem. As I said earlier (let me clarify) and to help you narrow things a little bit - it's probably due to the RADIUS response timing out hence the NAS complains the server is dead and later when it responds finally it marks it as alive again. The reasons can be different depending on your setup - slow network, database, custom module (like rlm_perl/ python etc) or as I suggested (from my personal experiences) improperly configured concurrence settings of FR itself. See which component of your setup is causing the slow responds (it can be the backend, or messed up FR configuration) and fix it. Just for completeness check your NASs manuals - most have these settings configurable - response timeouts, retransmits, marking the server as dead etc but playing with the NAS while possibly useful is probably not the main issue in your setup - check what is slowing things down. On 27.04.2009, at 15:41, A.L.M.Buxey(a)lboro.ac.uk wrote: > Hi, >> Same box. > > and you do live accounting database insertions? This sounds > to me very much like the classic 'tables have now grown just too > big' - everything works fine then barfs one day. the > request isnt getting serviced in time therefore its marking > as dead..check your query times...remove wrong/unused indexes > or move to 'out of band' accounting inserts - very easy with 2.1.x > > alan > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ------------------------------ Message: 5 Date: Mon, 27 Apr 2009 16:50:14 +0000 From: "David N'DAKPAZE" <lndakpaze(a)gmail.com> Subject: freeradius with active directory To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <16ad49990904270950v1fb0855bnff32138292a50585(a)mail.gmail.com> Content-Type: text/plain; charset="iso-8859-1" hello, I am configuring freeradius for authentication with active directory.I've used http://deployingradius.com/documents/configuration/active_directory but freeradius reject all the requests because of no known password.It what i have when i make a request: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 51084, id=198, length=61 User-Name = "azerty" User-Password = "uiop" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [suffix] No '@' in User-Name = "azerty", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Login incorrect: [azerty/uiop] (from client localhost port 0) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> azerty attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 198 to 127.0.0.1 port 51084 Waking up in 4.9 seconds. Cleaning up request 0 ID 198 with timestamp +27 Thanks for your help

2 1

error too many open files error reading radiusd.conf
by Angel Rivera 28 Apr '09

28 Apr '09

[root@ws11 ws11]# radiusd -x Starting - reading configuration files ... Errors reading dictionary: dict_init: /usr/share/freeradius/dictionary[55]: Couldn't open dictionary "/usr/share/freeradius/dictionary.compat": Too many open files Errors reading radiusd.conf I already adjusted the limit of my system [root@ws11 ws11]# ulimit -aH core file size (blocks, -c) unlimited data seg size (kbytes, -d) unlimited scheduling priority (-e) 0 file size (blocks, -f) unlimited pending signals (-i) 8176 max locked memory (kbytes, -l) 32 max memory size (kbytes, -m) unlimited open files (-n) 2048 pipe size (512 bytes, -p) 8 POSIX message queues (bytes, -q) 819200 real-time priority (-r) 0 stack size (kbytes, -s) unlimited cpu time (seconds, -t) unlimited max user processes (-u) 8176 virtual memory (kbytes, -v) unlimited file locks (-x) unlimited but still end up with the same problem -- ICQ# 209485063 YM: kuroro.rucilful(a)yahoo.com MSN: angelseiai(a)hotmail.com AIM: SevarSS http://www.pie.us

3 2

Re: Freeradius-Users Digest, Vol 48, Issue 116
by Angel Rivera 28 Apr '09

28 Apr '09

I also run this line su -c lsof | more and return a long list of files I really need help on this one. Is there anything that should be done to make the radiusd.conf readable > > > Message: 7 > Date: Tue, 28 Apr 2009 01:33:18 +0200 > From: "Edvin Seferovic" <edvin.seferovic(a)kolp.at> > Subject: RE: error too many open files error reading radiusd.conf > To: "'FreeRadius users mailing list'" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <038301c9c790$8b4b5d80$a1e21880$@seferovic@kolp.at> > Content-Type: text/plain; charset="us-ascii" > > Open files 2048 ?? > > > > Man LSOF ?? > > > > Regards, > > E:S > > > > From: freeradius-users-bounces+edvin.seferovic=kolp.at@ > lists.freeradius.org > [mailto:freeradius-users-bounces+edvin.seferovic<freeradius-users-bounces%2Bedvin.seferovic> > =kolp.at(a)lists.freeradius.or > g] On Behalf Of Angel Rivera > Sent: Dienstag, 28. April 2009 00:51 > To: freeradius-users(a)lists.freeradius.org > Subject: error too many open files error reading radiusd.conf > > > > > [root@ws11 ws11]# radiusd -x > Starting - reading configuration files ... > Errors reading dictionary: dict_init: /usr/share/freeradius/dictionary[55]: > Couldn't open dictionary "/usr/share/freeradius/dictionary.compat": Too > many > open files > Errors reading radiusd.conf > > > I already adjusted the limit of my system > > [root@ws11 ws11]# ulimit -aH > core file size (blocks, -c) unlimited > data seg size (kbytes, -d) unlimited > scheduling priority (-e) 0 > file size (blocks, -f) unlimited > pending signals (-i) 8176 > max locked memory (kbytes, -l) 32 > max memory size (kbytes, -m) unlimited > open files (-n) 2048 > pipe size (512 bytes, -p) 8 > POSIX message queues (bytes, -q) 819200 > real-time priority (-r) 0 > stack size (kbytes, -s) unlimited > cpu time (seconds, -t) unlimited > max user processes (-u) 8176 > virtual memory (kbytes, -v) unlimited > file locks (-x) unlimited > > > but still end up with the same problem > -- > ICQ# 209485063 > YM: kuroro.rucilful(a)yahoo.com > MSN: angelseiai(a)hotmail.com > AIM: SevarSS > > > http://www.pie.us > >

2 1

looking for a good "best practices" for campus-wide Freeradius installation
by john 27 Apr '09

27 Apr '09

Hi all, I'd would like to install .1x for all wired and wireless users across our campus by next fall. I'm looking for a really good howto/best practices for educational institutions. I hope folks on the list can point me to some good resources as I plan for deployment. Thanks! John

2 2

radpostauth sql logging of bad passwords
by Guy Fraser 27 Apr '09

27 Apr '09

I have installed : "radiusd: FreeRADIUS Version 2.1.3, for host i386-portbld-freebsd7.1, built on Feb 26 2009 at 15:47:46" I have not been able figure out how to get it to log failed authentication attempts into the radpostauth sql table, like I had it working in Version 1. -- Guy Fraser Network Administrator The Internet Centre 1-888-450-6787 (780)450-6787

3 8

freeradius with active directory
by David N'DAKPAZE 27 Apr '09

27 Apr '09

hello, I am configuring freeradius for authentication with active directory.I've used http://deployingradius.com/documents/configuration/active_directory but freeradius reject all the requests because of no known password.It what i have when i make a request: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 51084, id=198, length=61 User-Name = "azerty" User-Password = "uiop" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [suffix] No '@' in User-Name = "azerty", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Login incorrect: [azerty/uiop] (from client localhost port 0) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> azerty attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 198 to 127.0.0.1 port 51084 Waking up in 4.9 seconds. Cleaning up request 0 ID 198 with timestamp +27 Thanks for your help

3 3

%RADIUS-4-RADIUS_ALIVE | %RADIUS-4-RADIUS_DEAD help
by ramesh p 27 Apr '09

27 Apr '09

I'm seeing the following weirdness from my freeradiusserver and when i see the radiusd process its stopped status. why this happens. any valid reasons for this? Apr 26 00:18:44.498: %RADIUS-4-RADIUS_ALIVE: RADIUS server X.X.X.X:0,1813 is being marked alive. Apr 26 00:18:50.777: %RADIUS-4-RADIUS_DEAD: RADIUS server X.X.X.X:0,1813 is not responding. Apr 26 00:18:50.777: %RADIUS-4-RADIUS_ALIVE: RADIUS server X.X.X.X:0,1813 is being marked alive. Apr 26 00:18:59.133: %RADIUS-4-RADIUS_DEAD: RADIUS server X.X.X.X:0,1813 is not responding. Apr 26 00:18:59.133: %RADIUS-4-RADIUS_ALIVE: RADIUS server X.X.X.X:0,1813 is being marked alive. Apr 26 00:19:04.765: %RADIUS-4-RADIUS_DEAD: RADIUS server X.X.X.X:0,1813 is not responding. Thanks in advance. Regards, Rams.

5 13

RE: Adding vendor specefic attributes
by anoop c 27 Apr '09

27 Apr '09

Hi Is it possible to configure vendor specific attributes in Free RADIUS. Please guide where can I edit the configuration. I am using MAC authentication by editing the user file shown below. '020a6-5a7fd9 Auth-Type:=Local,User-Password=="secret" MAC authentication is working and I would like to add a vendor specific attribute. Regards Anoop Get your world in your inbox! Mail, widgets, documents, spreadsheets, organizer and much more with your Sifymail WIYI id! Log on to http://www.sify.com ********** DISCLAIMER ********** Information contained and transmitted by this E-MAIL is proprietary to Sify Limited and is intended for use only by the individual or entity to which it is addressed, and may contain information that is privileged, confidential or exempt from disclosure under applicable law. If this is a forwarded message, the content of this E-MAIL may not have been sent with the authority of the Company. If you are not the intended recipient, an agent of the intended recipient or a person responsible for delivering the information to the named recipient, you are notified that any use, distribution, transmission, printing, copying or dissemination of this information in any way or in any manner is strictly prohibited. If you have received this communication in error, please delete this mail & notify us immediately at admin(a)sifycorp.com

3 2

%RADIUS-4-RADIUS_ALIVE %RADIUS-4-RADIUS_DEAD help
by ramesh p 27 Apr '09

27 Apr '09

I'm getting the following messges/alarms from freereadius server version 1.1.6. and when i oberserved the radiusd process it's stopped. Why this happens? Apr 26 00:18:44.498: %RADIUS-4-RADIUS_ALIVE: RADIUS server 10.199.32.34:0,1813 is being marked alive. Apr 26 00:18:50.777: %RADIUS-4-RADIUS_DEAD: RADIUS server 10.199.32.34:0,1813 is not responding. Apr 26 00:18:50.777: %RADIUS-4-RADIUS_ALIVE: RADIUS server 10.199.32.34:0,1813 is being marked alive. Apr 26 00:18:59.133: %RADIUS-4-RADIUS_DEAD: RADIUS server 10.199.32.34:0,1813 is not responding. Apr 26 00:18:59.133: %RADIUS-4-RADIUS_ALIVE: RADIUS server 10.199.32.34:0,1813 is being marked alive. Apr 26 00:19:04.765: %RADIUS-4-RADIUS_DEAD: RADIUS server 10.199.32.34:0,1813 is not responding. Apr 26 00:19:04.765: %RADIUS-4-RADIUS_ALIVE: RADIUS server 10.199.32.34:0,1813 is being marked alive. Apr 26 00:19:11.293: %RADIUS-4-RADIUS_DEAD: RADIUS server 10.199.32.34:0,1813 is not responding. ... Please share the information. Regards, Rams..

1 0