- Freeradius-Users - lists.freeradius.org

Slightly OT: Problem with Vista
by Sergio Belkin 14 Dec '08

14 Dec '08

I have a problem with a Laptop with Vista (EAP-PEAP, and EAP-TTLS either won't work) tcpdump on access point outputs: 00:09:53.610223 02:1d:7e:dc:22:d9 (oui Unknown) > 00:1d:7e:dc:22:d9 (oui Unknown), ethertype Unknown (0x886c), length 72: 0x0000: 8001 0064 0000 1018 0001 0001 0000 0000 ...d............ 0x0010: 000c 0000 0000 0000 0008 0000 0000 0000 ................ 0x0020: 0000 001f 3a1b 4e8b 776c 3000 0000 d23f ....:.N.wl0....? 0x0030: 0000 0000 0000 e000 0000 .......... 00:09:54.143589 00:1f:3a:1b:4e:8b (oui Unknown) > Broadcast Null Unnumbered, xid, Flags [Command], length 6: 01 00 00:09:54.143758 02:1d:7e:dc:22:d9 (oui Unknown) > 00:1d:7e:dc:22:d9 (oui Unknown), ethertype Unknown (0x886c), length 98: 0x0000: 8001 007e 0000 1018 0001 0001 0000 0000 ...~............ 0x0010: 0008 0000 0000 0000 0000 0000 0000 0000 ................ 0x0020: 001a 001f 3a1b 4e8b 776c 3000 0000 d23f ....:.N.wl0....? 0x0030: 0000 0000 0000 e000 dd18 0050 f201 0100 ...........P.... 0x0040: 0050 f202 0100 0050 f202 0100 0050 f201 .P.....P.....P.. 0x0050: 0000 .. 00:09:54.167468 02:1d:7e:dc:22:d9 (oui Unknown) > 00:1d:7e:dc:22:d9 (oui Unknown), ethertype Unknown (0x886c), length 77: 0x0000: 8001 0069 0000 1018 0001 0001 0000 0000 ...i............ 0x0010: 0019 0000 0000 0000 0000 0000 0000 0000 ................ 0x0020: 0005 001f 3a1b 4e8b 776c 3000 0000 d23f ....:.N.wl0....? 0x0030: 0000 0000 0000 e000 0101 0000 0000 00 ............... 00:09:54.167512 EAP code=1 id=1 length=0 00:10:25.005568 02:1d:7e:dc:22:d9 (oui Unknown) > 00:1d:7e:dc:22:d9 (oui Unknown), ethertype Unknown (0x886c), length 72: 0x0000: 8001 0064 0000 1018 0001 0001 0000 0000 ...d............ 0x0010: 000c 0000 0000 0000 0008 0000 0000 0000 ................ 0x0020: 0000 001f 3a1b 4e8b 776c 3000 00c0 c980 ....:.N.wl0..... 0x0030: 0000 0000 5440 b600 0000 ....T@.... 00:10:25.561783 00:1f:3a:1b:4e:8b (oui Unknown) > Broadcast Null Unnumbered, xid, Flags [Command], length 6: 01 00 00:10:25.561952 02:1d:7e:dc:22:d9 (oui Unknown) > 00:1d:7e:dc:22:d9 (oui Unknown), ethertype Unknown (0x886c), length 98: 0x0000: 8001 007e 0000 1018 0001 0001 0000 0000 ...~............ 0x0010: 0008 0000 0000 0000 0000 0000 0000 0000 ................ 0x0020: 001a 001f 3a1b 4e8b 776c 3000 00c0 c980 ....:.N.wl0..... 0x0030: 0000 0000 5440 b600 dd18 0050 f201 0100 ....T@.....P.... 0x0040: 0050 f202 0100 0050 f202 0100 0050 f201 .P.....P.....P.. 0x0050: 0000 .. 00:10:25.585979 02:1d:7e:dc:22:d9 (oui Unknown) > 00:1d:7e:dc:22:d9 (oui Unknown), ethertype Unknown (0x886c), length 77: 0x0000: 8001 0069 0000 1018 0001 0001 0000 0000 ...i............ 0x0010: 0019 0000 0000 0000 0000 0000 0000 0000 ................ 0x0020: 0005 001f 3a1b 4e8b 776c 3000 00c0 c980 ....:.N.wl0..... 0x0030: 0000 0000 5440 b600 0101 0000 0000 00 ....T@......... 00:10:25.586025 EAP code=1 id=1 length=0 00:10:34.792686 02:1d:7e:dc:22:d9 (oui Unknown) > 00:1d:7e:dc:22:d9 (oui Unknown), ethertype Unknown (0x886c), length 72: 0x0000: 8001 0064 0000 1018 0001 0001 0000 0000 ...d............ 0x0010: 000c 0000 0000 0000 0008 0000 0000 0000 ................ 0x0020: 0000 001f 3a1b 4e8b 776c 3000 6c63 5f63 ....:.N.wl0.lc_c 0x0030: 6c6b 6374 6c5f 6300 0000 lkctl_c... 00:10:35.321712 00:1f:3a:1b:4e:8b (oui Unknown) > Broadcast Null Unnumbered, xid, Flags [Command], length 6: 01 00 00:10:35.321878 02:1d:7e:dc:22:d9 (oui Unknown) > 00:1d:7e:dc:22:d9 (oui Unknown), ethertype Unknown (0x886c), length 98: 0x0000: 8001 007e 0000 1018 0001 0001 0000 0000 ...~............ 0x0010: 0008 0000 0000 0000 0000 0000 0000 0000 ................ 0x0020: 001a 001f 3a1b 4e8b 776c 3000 6c63 5f63 ....:.N.wl0.lc_c 0x0030: 6c6b 6374 6c5f 6300 dd18 0050 f201 0100 lkctl_c....P.... 0x0040: 0050 f202 0100 0050 f202 0100 0050 f201 .P.....P.....P.. 0x0050: 0000 .. 00:10:35.344361 02:1d:7e:dc:22:d9 (oui Unknown) > 00:1d:7e:dc:22:d9 (oui Unknown), ethertype Unknown (0x886c), length 77: 0x0000: 8001 0069 0000 1018 0001 0001 0000 0000 ...i............ 0x0010: 0019 0000 0000 0000 0000 0000 0000 0000 ................ 0x0020: 0005 001f 3a1b 4e8b 776c 3000 6c63 5f63 ....:.N.wl0.lc_c 0x0030: 6c6b 6374 6c5f 6300 0101 0000 0000 00 lkctl_c........ 00:10:35.344405 EAP code=1 id=1 length=0 00:10:40.337072 02:1d:7e:dc:22:d9 (oui Unknown) > 00:1d:7e:dc:22:d9 (oui Unknown), ethertype Unknown (0x886c), length 77: 0x0000: 8001 0069 0000 1018 0001 0001 0000 0000 ...i............ 0x0010: 0019 0000 0000 0000 0000 0000 0000 0000 ................ 0x0020: 0005 001f 3a1b 4e8b 776c 3000 1000 0000 ....:.N.wl0..... 0x0030: 5000 0000 fc59 fb00 0101 0000 0000 00 P....Y......... 00:10:40.337119 EAP code=1 id=1 length=0 Please, what could be the problem? Thanks in advance -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

3 3

Re: R: R: Postgress SQL connections
by Alan DeKok 14 Dec '08

14 Dec '08

Massimiliano Tarquini wrote: > It seems to be exactly what is happening. > I have noticed a new think. When the radius crash, the database > administration interface continue showing the connection to the radius. > Using netstat onto the radius server there are no connection to the database > SERVER. > Is it possible? Yes. It's exactly what I have been trying to say. > May be the firewall? As I said, yes, it's the firewall. Stop trying to debug the problem. Stop trying to understand it. Go fix the firewall so that it doesn't destroy your network. Alan DeKok.

1 0

Re: R: Postgress SQL connections
by Alan DeKok 14 Dec '08

14 Dec '08

Massimiliano Tarquini wrote: > We are using the same freeradius as a proxy and it works fine running onto a > different machine. > The proxy auth the outer EAP-TTLS then asks to the radius to auth the inner. That still isn't a very clear description of the network configuration. > There is a firewall between the radius and the database (not between the > proxy and the database). May the firewall cause the problem? Yes. I've never understood why people put firewalls between critical network services. And *then* configure the firewalls to time out inactive connections. In this case, what's happening is this: - FreeRADIUS asks the Postgresql client library to open a socket to the server. - it does - 10 minutes later, the firewall decides that the TCP connection is unused, and discards all knowledge of it - FreeRADIUS receives a new request, and asks the postgresql client library to do an SQL query. - the postgresql library believes that the connection is still up, and tries to use it. - the firewall discards ALL packets for the connection - the kernel blocks all reads && writes that the postgresql client library tries to do.. - which then blocks FreeRADIUS. In short, configuring the firewall to discard sessions after 10 minutes or so of idle time is bad. *Especially* because the connections between FreeRADIUS && the DB are idle for longer than that. This is *not* a problem with FreeRADIUS. You have configured your firewall so that *it* is blocking the server. Fix your firewall, or remove it. Nothing else will solve the problem. Alan DeKok.

2 1

Re: Postgress SQL connections
by Alan DeKok 14 Dec '08

14 Dec '08

Massimiliano Tarquini wrote: > We have a full installation on freeradius 2.1.1 using postgreSql 8.1 running > onto 2 different machines. > The auth work fine 8we have tested it for two days with a killer script that > tests in continuously) but if the proxy What proxy? You haven't explained how you have the network set up. > stops sending auth requests for a > few minutes (sometimes 15, sometimes 40), at the first request freeradius > start malefunctioning. > Following the log content > > ---------------------------------------------------------------------------- > -------------------------------- > Sat Dec 13 16:19:38 2008 : Error: Discarding duplicate request from client ... > Sat Dec 13 16:20:01 2008 : Error: WARNING: Unresponsive child for request > 11657, in module sql component authorize That usually means that the database has blocked the server. The server is calling the DB client API to get data, and the API isn't returning. > Sat Dec 13 16:20:43 2008 : Info: rlm_sql (sql): There are no DB handles to > use! skipped 0, tried to connect 0 This happens when all of the DB connections are blocked. > Which is really strange is that the connections to the database are up and > the database works fine. The connections *exist*, but the server is telling you that they are not working. If the databse is working fine, then the problem is the DB client API. > After some retry the radius crash. See doc/bugs for instructions on what to do when this happens. > We tried to schedule a -HUP signal every 5 minutes, but it has non effect. The DB client API will likely re-try on interrupt signals. Alan DeKok.

2 1

freeradius 2.1.1 and postgres communication problem
by m.tarquini＠4it.it 14 Dec '08

14 Dec '08

Hi all, i’m sperimenting a strange problem using freeradius. We have a full installation on freeradius 2.1.1 using postgreSql 8.1 running onto 2 different machines. The auth work fine 8we have tested it for two days with a killer script that tests in continuously) but if the proxy stops sending auth requests for a few minutes (sometimes 15, sometimes 40), at the first request freeradius start malefunctioning. Following the log content ------------------------------------------------------------------------------------------------------------ Sat Dec 13 16:19:38 2008 : Error: Discarding duplicate request from client csnradpvip port 1814 - ID: 28 due to unfinished request 11657 Sat Dec 13 16:19:41 2008 : Error: Discarding duplicate request from client csnradpvip port 1814 - ID: 28 due to unfinished request 11657 Sat Dec 13 16:19:44 2008 : Error: Discarding duplicate request from client csnradpvip port 1814 - ID: 28 due to unfinished request 11657 Sat Dec 13 16:19:47 2008 : Error: Discarding duplicate request from client csnradpvip port 1814 - ID: 28 due to unfinished request 11657 Sat Dec 13 16:19:50 2008 : Error: Discarding duplicate request from client csnradpvip port 1814 - ID: 28 due to unfinished request 11657 Sat Dec 13 16:19:53 2008 : Error: Discarding duplicate request from client csnradpvip port 1814 - ID: 28 due to unfinished request 11657 Sat Dec 13 16:20:01 2008 : Error: WARNING: Unresponsive child for request 11657, in module sql component authorize Sat Dec 13 16:20:07 2008 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Sat Dec 13 16:20:13 2008 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Sat Dec 13 16:20:19 2008 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Sat Dec 13 16:20:25 2008 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Sat Dec 13 16:20:31 2008 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Sat Dec 13 16:20:37 2008 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Sat Dec 13 16:20:43 2008 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Sat Dec 13 16:20:49 2008 : Error: Received conflicting packet from client csnradpvip port 1814 - ID: 90 due to unfinished request 11627. Giving up on old request. Sat Dec 13 16:20:49 2008 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Sat Dec 13 16:20:55 2008 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Sat Dec 13 16:21:01 2008 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Sat Dec 13 16:21:07 2008 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 -------------------------------------------------------------------------------------------------------------- Which is really strange is that the connections to the database are up and the database works fine. After some retry the radius crash. We tried to schedule a -HUP signal every 5 minutes, but it has non effect. Please help me! -- This message was sent on behalf of m.tarquini(a)4it.it at openSubscriber.com http://www.opensubscriber.com/messages/freeradius-users@lists.freeradius.or…

1 0

Postgress SQL connections
by Massimiliano Tarquini 14 Dec '08

14 Dec '08

Hi all, im sperimenting a strange problem using freeradius. We have a full installation on freeradius 2.1.1 using postgreSql 8.1 running onto 2 different machines. The auth work fine 8we have tested it for two days with a killer script that tests in continuously) but if the proxy stops sending auth requests for a few minutes (sometimes 15, sometimes 40), at the first request freeradius start malefunctioning. Following the log content ---------------------------------------------------------------------------- -------------------------------- Sat Dec 13 16:19:38 2008 : Error: Discarding duplicate request from client csnradpvip port 1814 - ID: 28 due to unfinished request 11657 Sat Dec 13 16:19:41 2008 : Error: Discarding duplicate request from client csnradpvip port 1814 - ID: 28 due to unfinished request 11657 Sat Dec 13 16:19:44 2008 : Error: Discarding duplicate request from client csnradpvip port 1814 - ID: 28 due to unfinished request 11657 Sat Dec 13 16:19:47 2008 : Error: Discarding duplicate request from client csnradpvip port 1814 - ID: 28 due to unfinished request 11657 Sat Dec 13 16:19:50 2008 : Error: Discarding duplicate request from client csnradpvip port 1814 - ID: 28 due to unfinished request 11657 Sat Dec 13 16:19:53 2008 : Error: Discarding duplicate request from client csnradpvip port 1814 - ID: 28 due to unfinished request 11657 Sat Dec 13 16:20:01 2008 : Error: WARNING: Unresponsive child for request 11657, in module sql component authorize Sat Dec 13 16:20:07 2008 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Sat Dec 13 16:20:13 2008 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Sat Dec 13 16:20:19 2008 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Sat Dec 13 16:20:25 2008 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Sat Dec 13 16:20:31 2008 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Sat Dec 13 16:20:37 2008 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Sat Dec 13 16:20:43 2008 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Sat Dec 13 16:20:49 2008 : Error: Received conflicting packet from client csnradpvip port 1814 - ID: 90 due to unfinished request 11627. Giving up on old request. Sat Dec 13 16:20:49 2008 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Sat Dec 13 16:20:55 2008 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Sat Dec 13 16:21:01 2008 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Sat Dec 13 16:21:07 2008 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 ---------------------------------------------------------------------------- ---------------------------------- Which is really strange is that the connections to the database are up and the database works fine. After some retry the radius crash. We tried to schedule a -HUP signal every 5 minutes, but it has non effect. Please help me! 4IT S.r.l. Massimiliano Tarquini | Amministratore unico --------------------------------------------------------- Via Udine 30-36, 00161 Roma Phone +39 06 97601680 Mobile +39 392 9660669 Fax +39 06 97601683 m.tarquini(a)4it.it www.4it.it Il presente messaggio e gli eventuali allegati sono di natura confidenziale. Qualora vi fosse pervenuto per errore, vi preghiamo di cancellarlo immediatamente dal vostro sistema e di avvisare il mittente. Grazie. This electronic mail transmission and any accompanying attachments contain confidential information. If you have received this communication in error, please immediately delete the E-mail and either notify the sender. Thank you.

1 0

Client library for using CoA
by Padam J Singh 14 Dec '08

14 Dec '08

Hello, Are you aware of any radius client library which also implements CoA/Packet of Disconnect? I have checked radiusclient-ng and its earlier version - they do not contain any such feature. I saw that CoA is on the roadmap for FR (2007 announcement), any work done on it yet? Thanks, Padam -- PGP Id 9EED2E09

3 3

ownership change
by Norbert Wegener 14 Dec '08

14 Dec '08

Upgrading from 2.1.1 to 2.1.3 on a Suse10.2 system and restarting radiusd with the identical configuration showed the following message: We do not own /var/run/radiusd/radiusd.sock. ls -l /var/run/radiusd/radiusd.sock srw-rw---- 1 radiusd radiusd 0 12. Dez 16:18 /var/run/radiusd/radiusd.sock That fits to the entries user = radiusd group = radiusd in radiusd.conf. Removing radiusd.sock and restarting radiusd solved the problem. 2.1.3 obviously changed the ownership: ls -l /var/run/radiusd/radiusd.sock srw-rw---- 1 root radiusd 0 12. Dez 16:20 /var/run/radiusd/radiusd.sock Shouldn't the ownership still be radiusd.radiusd ? Norbert Wegener -- ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- Norbert Wegener Siemens IT Solutions and Services GmbH & Co. OHG SIS GO GIO NW PSU2 Kruppstraße 16 D-45128 Essen Phone : +49 (0) 201 816-3116 Fax. : +49 (0) 201 816-5581284 mailto:norbert.wegener@siemens.com Siemens IT Solutions and ServicesGmbH & Co. OHG Offene Handelsgesellschaft, Sitz der Gesellschaft: München; Registergericht: München, HRA 69235; Geschäftsführende Gesellschafterin: Siemens Business Services Beteiligungs-GmbH, Geschäftsführer: Christoph Kollatz, Vorsitzender; Jürgen Frischmuth, Michael Schulz-Drost; Sitz der Gesellschaft: München; Registergericht: München, HRB 50462; Weitere Gesellschafter: Siemens Business Services Investment GmbH & Co. KG, Sitz der Gesellschaft: München; Registergericht: München, HRA 86893; Persönlich haftende Gesellschafterin der Siemens Business Services Investment GmbH & Co. KG: Siemens Business Services Beteiligungs-GmbH, Geschäftsführer: Christoph Kollatz, Vorsitzender; Jürgen Frischmuth, Michael Schulz-Drost; Sitz der Gesellschaft: München; Registergericht: München, HRB 50462 WEEE-Reg.Nr. DE 88294312

2 2

RE: freeradius not responding on machine specific IPs
by Jason Wittlin-Cohen 13 Dec '08

13 Dec '08

Kevin, The relevant line is: "> rad_verify: Received Access-Reject packet from client 127.0.0.1 port 1812 with invalid signature (err=2)! (Shared secret is incorrect.)" The shared secret to authenticate a client to the RADIUS server (for RADIUS, not EAP traffic) is either not set, or you're using the wrong secret. By default there is no shared secret set for localhost. Edit clients.conf, search for 127.0.0.1. You'll find a line that looks like: ipaddr = 127.0.0.1 Now, add this line beneath: secret = secret Restart freeradius and try again. The message should go away. Remember, you're still going to get an access-reject response unless you setup the user account and password your authenticating with in the "users" file. Jason -- Jason Wittlin-Cohen Yale Law School, Class of 2010 jason.wittlin-cohen(a)yale.edu

3 4

FreeRADIUS and LDAP Groups
by Tim Gustafson 13 Dec '08

13 Dec '08

Now that I have FreeRADIUS authenticating users via MSCHAPv2 and the sambaNTPassword attributes, the next step in my project is to limit the system so that only users in certain user groups can log in. I'm using posixGroup groups, not groupOfNames or groupOfUniqueNames. In my modules/ldap files I have: groupname_attribute = "cn" groupmembership_attribute = "memberUid" groupmembership_filter = "(memberUid=%{Stripped-User-Name:-%{User-Name}})" In my users I have DEFAULT LDAP-Group == foo However, even with these configuration options set, anyone with a valid login and password can authenticate right now. In my "radiusd -X" I see: rlm_ldap: performing search in dc=blah, with filter (&(cn=foo)(memberUid=test)) rlm_ldap: object not found or got ambiguous search result But it then goes on the authenticate the user anyhow: rlm_ldap: user test authorized to use remote access I looked around on Google, and I see -lots- of stuff about configuring LDAP group checks, but I haven't found anything that's all too helpful right now. Is there some option that I have to set to tell the system to ignore a user that's not in the proper group? And then the follow-up question to this will be: is it possible to configure FreeRADIUS to check for membership in more than one group? Put another way, how can I let the system authenticate users in the "foo" group -or- in the "bar" group? Tim Gustafson SOE Webmaster UC Santa Cruz tjg(a)soe.ucsc.edu 831-459-5354

2 3