- Freeradius-Users - lists.freeradius.org

Freeradius on windows
by Mitul Modi 27 Apr '09

27 Apr '09

hi i have installed freeradius version 1.0.3 on windows xp. any body have resource to generate certificates on windows. thanks, mitul modi

2 2

pam_radius_auth configuration options
by F. Soriano 24 Apr '09

24 Apr '09

Hi list, I browsed quite a long time all previous threads and various material available on the web, with no success. So maybe someone can help wit this... I am using the latest available release of FreeRADIUS on my Linux server (RHEL 5.3, x86_64), with authentication against local users file. This works like a charm so far. Authentication is set up in this order: pam_radius_auto.so, then pam_unix.so. Is there a way to configure the pam_radius_auto.so module so that as long as the FreeRADIUS daemon is up and running, authentications will be *only* performed against FreeRADIUS, and all other authentication methods are ignored (even if this account exists locally, not in FreeRADIUS)? Of course, if FreeRADIUS is stopped or does not respond anymore, authentication against regular Linux files would work. I am only looking to make it work for the login process (local ttys). This is an example of my /etc/pam.d/login file: --snip-- #%PAM-1.0 auth [user_unknown=ignore success=ok ignore=ignore default=bad] pam_securetty.so auth [success=done new_authtok_reqd=done authinfo_unavail=ignore ignore=ignore default=die] pam_radius_auth.so ruser debug auth required pam_unix.so use_first_pass #auth include system-auth account required pam_nologin.so #account required pam_radius_auth.so #account include system-auth --snip-- I also tried with the "localifdown" keyword: --snip-- auth [success=done new_authtok_reqd=done ignore=ignore default=die] pam_radius_auth.so localifdown ruser debug --snip-- without success... Let's suppose I have a centralized account "remote-admin", and FreeRADIUS is the only one to know its password. Now I have another account, "local-admin", that is not declared within /etc/raddb/users file, but only in local /etc/passwd and /etc/shadow. With the first example, when FreeRADIUS is up, I can log in as remote-admin, and the logs shows that pam_radius_auth got clearance from radiusd. I can also log in as "local-admin", no matter if radiusd is up or not (the logs show that radiusd failed to respond, but that pam_unix accepted the credentials and then granted login). Thanks for your clues. Regards, Frank Créez votre adresse électronique prenom.nom(a)laposte.net 1 Go d'espace de stockage, anti-spam et anti-virus intégrés.

1 0

about /usr/local/sbin/checkrad
by Tseveendorj 24 Apr '09

24 Apr '09

Hello, Do I understand right or not about checkrad? Please drive me right direction. radius# checkrad Usage: checkrad nas_type nas_ip nas_port login session_id What is nas_port ? is it mean 1645, 1646 ? I found the session_id from cisco router with following command hostname#sh pppoe session all Total PPPoE sessions 3 *session id: 184* local MAC address: 001d.46c7.2630, remote MAC address: 00e0.a666.51eb virtual access interface: Vi2.2, outgoing interface: Gi0/0.1 206389 packets sent, 185625 received 246455857 bytes sent, 20392801 received is it ? Best regards, Tseveen.

4 3

eap-peap inner outer identity
by Per Hermansson 24 Apr '09

24 Apr '09

Hi I'm having troubles setting up EAP-PEAP with freeradius (2.1.0) + hostapd (0.6.9) + wpa_supplicant (0.6.6) What I've done is mostly to follow http://tldp.org/HOWTO/8021X-HOWTO/freeradius.html Which basically is to update eap.conf to use peap and add my login details to the users file: "testuser" User-Password == "Secret149" The problem is that I always get the following output from freeradius -X upon connecting: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 45567, id=1, length=168 User-Name = "0016dbd4b7d5" User-Password = "0016dbd4b7d5" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "00-21-91-F3-D2-21:My-radius" Calling-Station-Id = "00-16-EA-E5-C8-E6" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" ... No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. I've tried to search for the problem and I think it has to do with inner and outer identity since the User-Name is set to my MAC address. One solution suggested was to use virtual servers and have different users files for the outer and inner identity. But I haven't found an examples explaining how to do this. Per

5 8

Interesting new feature
by Alan DeKok 24 Apr '09

24 Apr '09

I've checked in some code to git that allows HUP to reload virtual server configurations. For now, all it does is reload the authorize, authenticate, accounting, pre-proxy, etc. sections. It does NOT reload listen sections, client sections, or anything else. However, it now allows you to update the policies in the virtual server configuration on the fly. If there is an error loading one of the virtual servers, then the NEW configuration for that virtual server is ignored, and the server keeps using the OLD (i.e. working) configuration. While there hasn't been a large demand for this feature, it's one step along the way to a complete reload on HUP, which *has* been requested. Alan DeKok.

3 4

Re: Hello Alan
by Glen Millard 23 Apr '09

23 Apr '09

On Thu, Apr 23, 2009 at 15:34, Glen Millard <glenmillard(a)gmail.com> wrote: > How are you sir? > > I will post this to the group if you want , but this is making me crazy: > > I am wondering the best way to troubleshoot this. > > Installing FreeRADIUS on CentOS 5: > radiusd: FreeRADIUS Version 2.1.5, for host i686-pc-linux-gnu, built on Apr > 23 2009 at 14:17:48 > > When I start it for the first time, it builds all of the 'fake' certs okay > and runs properly. > > (I am not sure if this would be an OpenSSL error or FreeRADIUS error. > What would you think the best way to troubleshoot this would be? > Or do you have any helpful hints?) > > However, when I attempt to build real certs, I see the following: > > > > > > > FreeRADIUS Version 2.1.5, for host i686-pc-linux-gnu, built on Apr 23 2009 at 14:17:48 > Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. > > There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A > PARTICULAR PURPOSE. > You may redistribute copies of FreeRADIUS under the terms of the > GNU General Public License v2. > Starting - reading configuration files ... > > including configuration file /usr/local/etc/raddb/radiusd.conf > including configuration file /usr/local/etc/raddb/proxy.conf > including configuration file /usr/local/etc/raddb/clients.conf > including files in directory /usr/local/etc/raddb/modules/ > > including configuration file /usr/local/etc/raddb/modules/acct_unique > including configuration file /usr/local/etc/raddb/modules/chap > including configuration file /usr/local/etc/raddb/modules/attr_rewrite > including configuration file /usr/local/etc/raddb/modules/preprocess > > including configuration file /usr/local/etc/raddb/modules/ippool > including configuration file /usr/local/etc/raddb/modules/pap > including configuration file /usr/local/etc/raddb/modules/checkval > including configuration file /usr/local/etc/raddb/modules/expiration > > including configuration file /usr/local/etc/raddb/modules/files > including configuration file /usr/local/etc/raddb/modules/realm > including configuration file /usr/local/etc/raddb/modules/sql_log > including configuration file /usr/local/etc/raddb/modules/linelog > > including configuration file /usr/local/etc/raddb/modules/detail.log > including configuration file /usr/local/etc/raddb/modules/logintime > including configuration file /usr/local/etc/raddb/modules/digest > including configuration file /usr/local/etc/raddb/modules/krb5 > > including configuration file /usr/local/etc/raddb/modules/inner-eap > including configuration file /usr/local/etc/raddb/modules/mschap > including configuration file /usr/local/etc/raddb/modules/perl > including configuration file /usr/local/etc/raddb/modules/attr_filter > > including configuration file /usr/local/etc/raddb/modules/etc_group > including configuration file /usr/local/etc/raddb/modules/counter > including configuration file /usr/local/etc/raddb/modules/smsotp > including configuration file /usr/local/etc/raddb/modules/radutmp > > including configuration file /usr/local/etc/raddb/modules/unix > including configuration file /usr/local/etc/raddb/modules/exec > including configuration file /usr/local/etc/raddb/modules/ldap > including configuration file /usr/local/etc/raddb/modules/passwd > > including configuration file /usr/local/etc/raddb/modules/mac2ip > including configuration file /usr/local/etc/raddb/modules/detail > including configuration file /usr/local/etc/raddb/modules/sradutmp > including configuration file /usr/local/etc/raddb/modules/wimax > > including configuration file /usr/local/etc/raddb/modules/otp > including configuration file /usr/local/etc/raddb/modules/policy > including configuration file /usr/local/etc/raddb/modules/smbpasswd > including configuration file /usr/local/etc/raddb/modules/detail.example.com > > including configuration file /usr/local/etc/raddb/modules/mac2vlan > including configuration file /usr/local/etc/raddb/modules/always > including configuration file /usr/local/etc/raddb/modules/expr > including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login > > including configuration file /usr/local/etc/raddb/modules/echo > including configuration file /usr/local/etc/raddb/modules/pam > including configuration file /usr/local/etc/raddb/eap.conf > including configuration file /usr/local/etc/raddb/policy.conf > > including files in directory /usr/local/etc/raddb/sites-enabled/ > including configuration file /usr/local/etc/raddb/sites-enabled/control-socket > including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel > > including configuration file /usr/local/etc/raddb/sites-enabled/default > including dictionary file /usr/local/etc/raddb/dictionary > main { > prefix = "/usr/local" > localstatedir = "/usr/local/var" > > logdir = "/usr/local/var/log/radius" > libdir = "/usr/local/lib" > radacctdir = "/usr/local/var/log/radius/radacct" > hostname_lookups = no > max_request_time = 30 > cleanup_delay = 5 > > max_requests = 1024 > allow_core_dumps = no > pidfile = "/usr/local/var/run/radiusd/radiusd.pid" > checkrad = "/usr/local/sbin/checkrad" > debug_level = 0 > proxy_requests = yes > log { > > stripped_names = no > auth = no > auth_badpass = no > auth_goodpass = no > } > security { > max_attributes = 200 > reject_delay = 1 > status_server = yes > } > } > radiusd: #### Loading Realms and Home Servers #### > > proxy server { > retry_delay = 5 > retry_count = 3 > default_fallback = no > dead_time = 120 > wake_all_if_all_dead = no > } > home_server localhost { > ipaddr = 127.0.0.1 > port = 1812 > type = "auth" > > secret = "testing123" > response_window = 20 > max_outstanding = 65536 > require_message_authenticator = no > zombie_period = 40 > status_check = "status-server" > ping_interval = 30 > check_interval = 30 > > num_answers_to_alive = 3 > num_pings_to_alive = 3 > revive_interval = 120 > status_check_timeout = 4 > irt = 2 > mrt = 16 > mrc = 5 > mrd = 30 > } > home_server_pool my_auth_failover { > type = fail-over > > home_server = localhost > } > realm example.com { > auth_pool = my_auth_failover > } > realm LOCAL { > } > radiusd: #### Loading Clients #### > client localhost { > ipaddr = 127.0.0.1 > > require_message_authenticator = no > secret = "testing123" > nastype = "other" > } > radiusd: #### Instantiating modules #### > instantiate { > Module: Linked to module rlm_exec > Module: Instantiating exec > > exec { > wait = no > input_pairs = "request" > shell_escape = yes > } > Module: Linked to module rlm_expr > Module: Instantiating expr > Module: Linked to module rlm_expiration > Module: Instantiating expiration > > expiration { > reply-message = "Password Has Expired " > } > Module: Linked to module rlm_logintime > Module: Instantiating logintime > logintime { > reply-message = "You are calling outside your allowed timespan " > > minimum-timeout = 60 > } > } > radiusd: #### Loading Virtual Servers #### > server inner-tunnel { > modules { > Module: Checking authenticate {...} for more modules to load > Module: Linked to module rlm_pap > > Module: Instantiating pap > pap { > encryption_scheme = "auto" > auto_header = no > } > Module: Linked to module rlm_chap > Module: Instantiating chap > Module: Linked to module rlm_mschap > Module: Instantiating mschap > > mschap { > use_mppe = yes > require_encryption = no > require_strong = no > with_ntdomain_hack = no > } > Module: Linked to module rlm_unix > Module: Instantiating unix > unix { > radwtmp = "/usr/local/var/log/radius/radwtmp" > > } > Module: Linked to module rlm_eap > Module: Instantiating eap > eap { > default_eap_type = "md5" > timer_expire = 60 > ignore_unknown_eap_types = no > cisco_accounting_username_bug = no > max_sessions = 2048 > > } > Module: Linked to sub-module rlm_eap_md5 > Module: Instantiating eap-md5 > Module: Linked to sub-module rlm_eap_leap > Module: Instantiating eap-leap > Module: Linked to sub-module rlm_eap_gtc > Module: Instantiating eap-gtc > > gtc { > challenge = "Password: " > auth_type = "PAP" > } > Module: Linked to sub-module rlm_eap_tls > Module: Instantiating eap-tls > tls { > rsa_key_exchange = no > dh_key_exchange = yes > > rsa_key_length = 512 > dh_key_length = 512 > verify_depth = 0 > pem_file_type = yes > private_key_file = "/usr/local/etc/raddb/certs/server.pem" > certificate_file = "/usr/local/etc/raddb/certs/server.pem" > > CA_file = "/usr/local/etc/raddb/certs/ca.pem" > private_key_password = "rifywbi!" > dh_file = "/usr/local/etc/raddb/certs/dh" > random_file = "/usr/local/etc/raddb/certs/random" > > fragment_size = 1024 > include_length = yes > check_crl = no > cipher_list = "DEFAULT" > make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" > cache { > enable = no > lifetime = 24 > > max_entries = 255 > } > } > rlm_eap: SSL error error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt > rlm_eap_tls: Error reading private key file /usr/local/etc/raddb/certs/server.pem > rlm_eap: Failed to initialize type tls > > /usr/local/etc/raddb/eap.conf[17]: Instantiation failed for module "eap" > /usr/local/etc/raddb/sites-enabled/inner-tunnel[223]: Failed to find module "eap". > /usr/local/etc/raddb/sites-enabled/inner-tunnel[176]: Errors parsing authenticate section. > > } > } > Errors initializing modules > > > >

3 4

Centos 5.3 problem
by Apostolos Pantsiopoulos 23 Apr '09

23 Apr '09

I was running freeradius 2.0.5 on my Centos 5.2 server using rlm_perl. When I upgraded to 5.3 I get : "rlm_perl: perl_parse failed: /billing/bin/billing.pl not found or has syntax errors." I googled it and found that this may be caused by libperl.so not being linked properly or Data::Dumper that needs to be recompiled. I have done everything that the mailing list suggested but the problem persists. Any ideas -- ------------------------------------------- Apostolos Pantsiopoulos Kinetix Tele.com R & D email: regs(a)kinetix.gr -------------------------------------------

2 2

how to Simultaneous-Use
by Tseveendorj 23 Apr '09

23 Apr '09

Hello, Following packages installed on my server. FreeRADIUS 2.1.4 Perl 5.8.9 p5-SNMP_Session-1.12 p5-Net-Telnet-3.03 MySQL-5.0.77 I decided to use SNMP_Session and BER modules. When I'm executing checkrad by hand then I got following message. # checkrad cisco 192.168.0.60 1645 tseveen 40 SNMP Error: Received SNMP response with error code error status: noSuchName index 1 (OID: 1.3.6.1.4.1.9.2.9.2.1.18.1645) SNMPv1_Session (remote host: "192.168.0.60" [192.168.0.60].161) community: "public" request ID: -17216476 PDU bufsize: 8000 bytes timeout: 2s retries: 5 backoff: 1) at /usr/local/sbin/checkrad line 221 checkrad: No SNMP answer from cisco. checkrad: not found! I thought maybe OID is not compatible for my router c3825. is it ? Can you please provide more information about NAS port and Session ID ? Tseveen.

3 4

performance freeradius with psql (auth only)
by Uwe Kastens 23 Apr '09

23 Apr '09

Hi lists, I am just measuring (maybe more guessing) some performance figures. I started 3 radclients (1 on localhost, 2 on different remote hosts) with 12K different user and credentials. I am working with virtual hosts under XEN. I am just counting the logfile entries from logfile for Auth: Login entries. With a single radclient from a remote host its something between 10 to 15 auth per sec. With 3 radclients its something between 30 to 45 auth per sec. There is no change in that values, if I increase the max database connections. So I think it might be a problem, that there are not enough requests produced from the radclient(s) aprox 800 per minute. Could that be? Any other figures measured by someone? BR Uwe -- kiste lat: 54.322684, lon: 10.13586

3 4

failover and load balancing
by Kanwar Ranbir Sandhu 23 Apr '09

23 Apr '09

Hello Everyone, I'm stepping into the world of Freeradius for the first time - holy shit is there a lot to learn. Anyway, I've been wondering how many servers are required to have a proper (i.e. no single point of failure) on the freeradius side of things. I know that I can have one freeradius server proxying requests to any number of authorization and/or accounting servers - great. But, what if I don't want to proxy and only want two freeradius servers that do auth, and two separate servers for accounting? I can conceptualize a cluster or even simple fail over using heartbeat for the database bit. What I don't understand is how the failover and load balancing is done on the freeradius level (i.e. for auth) and still enter a single IP for freeradius on the NAS. Am I supposed to configure a virtual server on the first freeradius server, copy the config to the second machine, and then use that virtual server IP on the NAS? I don't get it. I must be missing something. Any help would be appreciated. Regards, Ranbir -- Kanwar Ranbir Sandhu Linux 2.6.27.21-170.2.56.fc10.x86_64 x86_64 GNU/Linux 13:45:51 up 3 days, 13:42, 3 users, load average: 1.07, 0.61, 0.50

14 23