- Freeradius-Users - lists.freeradius.org

about /usr/local/sbin/checkrad
by Tseveendorj 24 Apr '09

24 Apr '09

Hello, Do I understand right or not about checkrad? Please drive me right direction. radius# checkrad Usage: checkrad nas_type nas_ip nas_port login session_id What is nas_port ? is it mean 1645, 1646 ? I found the session_id from cisco router with following command hostname#sh pppoe session all Total PPPoE sessions 3 *session id: 184* local MAC address: 001d.46c7.2630, remote MAC address: 00e0.a666.51eb virtual access interface: Vi2.2, outgoing interface: Gi0/0.1 206389 packets sent, 185625 received 246455857 bytes sent, 20392801 received is it ? Best regards, Tseveen.

4 3

eap-peap inner outer identity
by Per Hermansson 24 Apr '09

24 Apr '09

Hi I'm having troubles setting up EAP-PEAP with freeradius (2.1.0) + hostapd (0.6.9) + wpa_supplicant (0.6.6) What I've done is mostly to follow http://tldp.org/HOWTO/8021X-HOWTO/freeradius.html Which basically is to update eap.conf to use peap and add my login details to the users file: "testuser" User-Password == "Secret149" The problem is that I always get the following output from freeradius -X upon connecting: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 45567, id=1, length=168 User-Name = "0016dbd4b7d5" User-Password = "0016dbd4b7d5" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "00-21-91-F3-D2-21:My-radius" Calling-Station-Id = "00-16-EA-E5-C8-E6" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" ... No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. I've tried to search for the problem and I think it has to do with inner and outer identity since the User-Name is set to my MAC address. One solution suggested was to use virtual servers and have different users files for the outer and inner identity. But I haven't found an examples explaining how to do this. Per

5 8

Interesting new feature
by Alan DeKok 24 Apr '09

24 Apr '09

I've checked in some code to git that allows HUP to reload virtual server configurations. For now, all it does is reload the authorize, authenticate, accounting, pre-proxy, etc. sections. It does NOT reload listen sections, client sections, or anything else. However, it now allows you to update the policies in the virtual server configuration on the fly. If there is an error loading one of the virtual servers, then the NEW configuration for that virtual server is ignored, and the server keeps using the OLD (i.e. working) configuration. While there hasn't been a large demand for this feature, it's one step along the way to a complete reload on HUP, which *has* been requested. Alan DeKok.

3 4

Re: Hello Alan
by Glen Millard 23 Apr '09

23 Apr '09

On Thu, Apr 23, 2009 at 15:34, Glen Millard <glenmillard(a)gmail.com> wrote: > How are you sir? > > I will post this to the group if you want , but this is making me crazy: > > I am wondering the best way to troubleshoot this. > > Installing FreeRADIUS on CentOS 5: > radiusd: FreeRADIUS Version 2.1.5, for host i686-pc-linux-gnu, built on Apr > 23 2009 at 14:17:48 > > When I start it for the first time, it builds all of the 'fake' certs okay > and runs properly. > > (I am not sure if this would be an OpenSSL error or FreeRADIUS error. > What would you think the best way to troubleshoot this would be? > Or do you have any helpful hints?) > > However, when I attempt to build real certs, I see the following: > > > > > > > FreeRADIUS Version 2.1.5, for host i686-pc-linux-gnu, built on Apr 23 2009 at 14:17:48 > Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. > > There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A > PARTICULAR PURPOSE. > You may redistribute copies of FreeRADIUS under the terms of the > GNU General Public License v2. > Starting - reading configuration files ... > > including configuration file /usr/local/etc/raddb/radiusd.conf > including configuration file /usr/local/etc/raddb/proxy.conf > including configuration file /usr/local/etc/raddb/clients.conf > including files in directory /usr/local/etc/raddb/modules/ > > including configuration file /usr/local/etc/raddb/modules/acct_unique > including configuration file /usr/local/etc/raddb/modules/chap > including configuration file /usr/local/etc/raddb/modules/attr_rewrite > including configuration file /usr/local/etc/raddb/modules/preprocess > > including configuration file /usr/local/etc/raddb/modules/ippool > including configuration file /usr/local/etc/raddb/modules/pap > including configuration file /usr/local/etc/raddb/modules/checkval > including configuration file /usr/local/etc/raddb/modules/expiration > > including configuration file /usr/local/etc/raddb/modules/files > including configuration file /usr/local/etc/raddb/modules/realm > including configuration file /usr/local/etc/raddb/modules/sql_log > including configuration file /usr/local/etc/raddb/modules/linelog > > including configuration file /usr/local/etc/raddb/modules/detail.log > including configuration file /usr/local/etc/raddb/modules/logintime > including configuration file /usr/local/etc/raddb/modules/digest > including configuration file /usr/local/etc/raddb/modules/krb5 > > including configuration file /usr/local/etc/raddb/modules/inner-eap > including configuration file /usr/local/etc/raddb/modules/mschap > including configuration file /usr/local/etc/raddb/modules/perl > including configuration file /usr/local/etc/raddb/modules/attr_filter > > including configuration file /usr/local/etc/raddb/modules/etc_group > including configuration file /usr/local/etc/raddb/modules/counter > including configuration file /usr/local/etc/raddb/modules/smsotp > including configuration file /usr/local/etc/raddb/modules/radutmp > > including configuration file /usr/local/etc/raddb/modules/unix > including configuration file /usr/local/etc/raddb/modules/exec > including configuration file /usr/local/etc/raddb/modules/ldap > including configuration file /usr/local/etc/raddb/modules/passwd > > including configuration file /usr/local/etc/raddb/modules/mac2ip > including configuration file /usr/local/etc/raddb/modules/detail > including configuration file /usr/local/etc/raddb/modules/sradutmp > including configuration file /usr/local/etc/raddb/modules/wimax > > including configuration file /usr/local/etc/raddb/modules/otp > including configuration file /usr/local/etc/raddb/modules/policy > including configuration file /usr/local/etc/raddb/modules/smbpasswd > including configuration file /usr/local/etc/raddb/modules/detail.example.com > > including configuration file /usr/local/etc/raddb/modules/mac2vlan > including configuration file /usr/local/etc/raddb/modules/always > including configuration file /usr/local/etc/raddb/modules/expr > including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login > > including configuration file /usr/local/etc/raddb/modules/echo > including configuration file /usr/local/etc/raddb/modules/pam > including configuration file /usr/local/etc/raddb/eap.conf > including configuration file /usr/local/etc/raddb/policy.conf > > including files in directory /usr/local/etc/raddb/sites-enabled/ > including configuration file /usr/local/etc/raddb/sites-enabled/control-socket > including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel > > including configuration file /usr/local/etc/raddb/sites-enabled/default > including dictionary file /usr/local/etc/raddb/dictionary > main { > prefix = "/usr/local" > localstatedir = "/usr/local/var" > > logdir = "/usr/local/var/log/radius" > libdir = "/usr/local/lib" > radacctdir = "/usr/local/var/log/radius/radacct" > hostname_lookups = no > max_request_time = 30 > cleanup_delay = 5 > > max_requests = 1024 > allow_core_dumps = no > pidfile = "/usr/local/var/run/radiusd/radiusd.pid" > checkrad = "/usr/local/sbin/checkrad" > debug_level = 0 > proxy_requests = yes > log { > > stripped_names = no > auth = no > auth_badpass = no > auth_goodpass = no > } > security { > max_attributes = 200 > reject_delay = 1 > status_server = yes > } > } > radiusd: #### Loading Realms and Home Servers #### > > proxy server { > retry_delay = 5 > retry_count = 3 > default_fallback = no > dead_time = 120 > wake_all_if_all_dead = no > } > home_server localhost { > ipaddr = 127.0.0.1 > port = 1812 > type = "auth" > > secret = "testing123" > response_window = 20 > max_outstanding = 65536 > require_message_authenticator = no > zombie_period = 40 > status_check = "status-server" > ping_interval = 30 > check_interval = 30 > > num_answers_to_alive = 3 > num_pings_to_alive = 3 > revive_interval = 120 > status_check_timeout = 4 > irt = 2 > mrt = 16 > mrc = 5 > mrd = 30 > } > home_server_pool my_auth_failover { > type = fail-over > > home_server = localhost > } > realm example.com { > auth_pool = my_auth_failover > } > realm LOCAL { > } > radiusd: #### Loading Clients #### > client localhost { > ipaddr = 127.0.0.1 > > require_message_authenticator = no > secret = "testing123" > nastype = "other" > } > radiusd: #### Instantiating modules #### > instantiate { > Module: Linked to module rlm_exec > Module: Instantiating exec > > exec { > wait = no > input_pairs = "request" > shell_escape = yes > } > Module: Linked to module rlm_expr > Module: Instantiating expr > Module: Linked to module rlm_expiration > Module: Instantiating expiration > > expiration { > reply-message = "Password Has Expired " > } > Module: Linked to module rlm_logintime > Module: Instantiating logintime > logintime { > reply-message = "You are calling outside your allowed timespan " > > minimum-timeout = 60 > } > } > radiusd: #### Loading Virtual Servers #### > server inner-tunnel { > modules { > Module: Checking authenticate {...} for more modules to load > Module: Linked to module rlm_pap > > Module: Instantiating pap > pap { > encryption_scheme = "auto" > auto_header = no > } > Module: Linked to module rlm_chap > Module: Instantiating chap > Module: Linked to module rlm_mschap > Module: Instantiating mschap > > mschap { > use_mppe = yes > require_encryption = no > require_strong = no > with_ntdomain_hack = no > } > Module: Linked to module rlm_unix > Module: Instantiating unix > unix { > radwtmp = "/usr/local/var/log/radius/radwtmp" > > } > Module: Linked to module rlm_eap > Module: Instantiating eap > eap { > default_eap_type = "md5" > timer_expire = 60 > ignore_unknown_eap_types = no > cisco_accounting_username_bug = no > max_sessions = 2048 > > } > Module: Linked to sub-module rlm_eap_md5 > Module: Instantiating eap-md5 > Module: Linked to sub-module rlm_eap_leap > Module: Instantiating eap-leap > Module: Linked to sub-module rlm_eap_gtc > Module: Instantiating eap-gtc > > gtc { > challenge = "Password: " > auth_type = "PAP" > } > Module: Linked to sub-module rlm_eap_tls > Module: Instantiating eap-tls > tls { > rsa_key_exchange = no > dh_key_exchange = yes > > rsa_key_length = 512 > dh_key_length = 512 > verify_depth = 0 > pem_file_type = yes > private_key_file = "/usr/local/etc/raddb/certs/server.pem" > certificate_file = "/usr/local/etc/raddb/certs/server.pem" > > CA_file = "/usr/local/etc/raddb/certs/ca.pem" > private_key_password = "rifywbi!" > dh_file = "/usr/local/etc/raddb/certs/dh" > random_file = "/usr/local/etc/raddb/certs/random" > > fragment_size = 1024 > include_length = yes > check_crl = no > cipher_list = "DEFAULT" > make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" > cache { > enable = no > lifetime = 24 > > max_entries = 255 > } > } > rlm_eap: SSL error error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt > rlm_eap_tls: Error reading private key file /usr/local/etc/raddb/certs/server.pem > rlm_eap: Failed to initialize type tls > > /usr/local/etc/raddb/eap.conf[17]: Instantiation failed for module "eap" > /usr/local/etc/raddb/sites-enabled/inner-tunnel[223]: Failed to find module "eap". > /usr/local/etc/raddb/sites-enabled/inner-tunnel[176]: Errors parsing authenticate section. > > } > } > Errors initializing modules > > > >

3 4

Centos 5.3 problem
by Apostolos Pantsiopoulos 23 Apr '09

23 Apr '09

I was running freeradius 2.0.5 on my Centos 5.2 server using rlm_perl. When I upgraded to 5.3 I get : "rlm_perl: perl_parse failed: /billing/bin/billing.pl not found or has syntax errors." I googled it and found that this may be caused by libperl.so not being linked properly or Data::Dumper that needs to be recompiled. I have done everything that the mailing list suggested but the problem persists. Any ideas -- ------------------------------------------- Apostolos Pantsiopoulos Kinetix Tele.com R & D email: regs(a)kinetix.gr -------------------------------------------

2 2

how to Simultaneous-Use
by Tseveendorj 23 Apr '09

23 Apr '09

Hello, Following packages installed on my server. FreeRADIUS 2.1.4 Perl 5.8.9 p5-SNMP_Session-1.12 p5-Net-Telnet-3.03 MySQL-5.0.77 I decided to use SNMP_Session and BER modules. When I'm executing checkrad by hand then I got following message. # checkrad cisco 192.168.0.60 1645 tseveen 40 SNMP Error: Received SNMP response with error code error status: noSuchName index 1 (OID: 1.3.6.1.4.1.9.2.9.2.1.18.1645) SNMPv1_Session (remote host: "192.168.0.60" [192.168.0.60].161) community: "public" request ID: -17216476 PDU bufsize: 8000 bytes timeout: 2s retries: 5 backoff: 1) at /usr/local/sbin/checkrad line 221 checkrad: No SNMP answer from cisco. checkrad: not found! I thought maybe OID is not compatible for my router c3825. is it ? Can you please provide more information about NAS port and Session ID ? Tseveen.

3 4

performance freeradius with psql (auth only)
by Uwe Kastens 23 Apr '09

23 Apr '09

Hi lists, I am just measuring (maybe more guessing) some performance figures. I started 3 radclients (1 on localhost, 2 on different remote hosts) with 12K different user and credentials. I am working with virtual hosts under XEN. I am just counting the logfile entries from logfile for Auth: Login entries. With a single radclient from a remote host its something between 10 to 15 auth per sec. With 3 radclients its something between 30 to 45 auth per sec. There is no change in that values, if I increase the max database connections. So I think it might be a problem, that there are not enough requests produced from the radclient(s) aprox 800 per minute. Could that be? Any other figures measured by someone? BR Uwe -- kiste lat: 54.322684, lon: 10.13586

3 4

failover and load balancing
by Kanwar Ranbir Sandhu 23 Apr '09

23 Apr '09

Hello Everyone, I'm stepping into the world of Freeradius for the first time - holy shit is there a lot to learn. Anyway, I've been wondering how many servers are required to have a proper (i.e. no single point of failure) on the freeradius side of things. I know that I can have one freeradius server proxying requests to any number of authorization and/or accounting servers - great. But, what if I don't want to proxy and only want two freeradius servers that do auth, and two separate servers for accounting? I can conceptualize a cluster or even simple fail over using heartbeat for the database bit. What I don't understand is how the failover and load balancing is done on the freeradius level (i.e. for auth) and still enter a single IP for freeradius on the NAS. Am I supposed to configure a virtual server on the first freeradius server, copy the config to the second machine, and then use that virtual server IP on the NAS? I don't get it. I must be missing something. Any help would be appreciated. Regards, Ranbir -- Kanwar Ranbir Sandhu Linux 2.6.27.21-170.2.56.fc10.x86_64 x86_64 GNU/Linux 13:45:51 up 3 days, 13:42, 3 users, load average: 1.07, 0.61, 0.50

14 23

RE: Freeradius 2.1.5 and Solaris gmake install problem. (Solved)
by Ville Leinonen 22 Apr '09

22 Apr '09

Hi, I try to make "gmake clean" and try again. Now everything went fine. Maybe Moon is moving again for new position :) Br, Ville -----Original Message----- From: freeradius-users-bounces+ville.leinonen=solodel.com(a)lists.freeradius.org on behalf of Alan DeKok Sent: Mon 20/04/2009 14:42 To: FreeRadius users mailing list Subject: Re: Freeradius 2.1.5 and Solaris gmake install problem. Ville Leinonen wrote: > Yes i go make "gmake" before 2gmake install" and i went fine. <shrug> It works for me on the Solaris Sparc / x86 boxes I have access to. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Releasing 2.1.5 or 2.1.6
by John Dennis 22 Apr '09

22 Apr '09

I'd like to package up the current release but I can't because the current tar files have version problems. What is currently on the download link is 2.1.4 but builds as 2.1.5. There have been two different versions of the 2.1.4 tar file. This means we can never release a 2.1.4 RPM because it's versioning is ambiguous. IMHO the 2.1.4 release should be considered defunct. There is a 2.1.5 trial version on the build server that I've lightly tested, perhaps others should as well. Can we move the next release forward to an official release so we can get a release out to supercede the current version, which to my thinking is 2.1.3 (because 2.1.4 is not identifiable). P.S.: We also need to be careful, if what becomes 2.1.5 is not identical to what's in the 2.1.4 tar file we should go to 2.1.6 because we won't be able to disambiguate between a 2.1.5 built from a 2.1.4 tar file and the actual 2.1.5 built from a 2.1.5 tar file. This means the next release should probably be 2.1.6 with 2.14 and 2.1.5 marked as suspect in the changelog. -- John Dennis <jdennis(a)redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/

4 5