- Freeradius-Users - lists.freeradius.org

rlm_perl bug?
by patrice.oliver＠ch-beaune.fr 08 Aug '08

08 Aug '08

Bonjour, je suis actuellement en cong�s pour 3 semaines. Je suis de retour le 1er septembre 2008. En cas d'urgence, vous pouvez contacter Monsieur Tixier au 03 80 24 44 27 ou la maintenance informatique au 03 80 24 45 84. Cordialement.

1 0

rlm_perl bug?
by Alex Balashov 08 Aug '08

08 Aug '08

Greetings, I am running into a strange problem with the rlm_perl module. I am using some Perl middleware to do additional processing on some custom vendor accounting attributes and log them to MS-SQL via UnixODBC, in addition to using rlm_unixodbc for logging the basic accounting attributes. (As I'm sure you can imagine, I ran into a lot of problems with DB handle sharing and thread pools and DB slowness. But I have managed to mostly solve this by using the right combination of threads, maximum requests per server, # of Perl clones, etc. to make it work.) The issue I have is that the RADIUS server will run for 1-2 days under a fairly moderate load, and then abruptly crash (apparently) with this: Thu Aug 7 22:52:00 2008 : rlm_perl: Handling START record. Thu Aug 7 22:52:00 2008 : rlm_perl: Processing record type 1 Thu Aug 7 22:52:00 2008 : rlm_perl: Handling START record. Thu Aug 7 22:52:00 2008 : rlm_perl: Processing record type 1 Thu Aug 7 22:52:00 2008 : rlm_perl: Processing record type 1 Thu Aug 7 22:52:00 2008 : rlm_perl: Handling START record. Thu Aug 7 22:52:00 2008 : rlm_perl: Processing record type 1 Thu Aug 7 22:52:00 2008 : rlm_perl: Handling START record. Thu Aug 7 22:52:00 2008 : rlm_perl: Processing record type 1 Thu Aug 7 22:52:00 2008 : Error: Could not get @DynaLoader::dl_librefs for unloading. The latter is a Perl error. Now, DynaLoader::dl_librefs is a symbol that is loaded by the interpreter upon boot and is used in every clone invocation, so if the problem were simply that the module wasn't there, it would fail immediately. Instead, it happens once in a blue moon. The RADIUS server then stops and must be manually restarted. Any idea why? Thanks much! -- Alex Balashov Evariste Systems Web : http://www.evaristesys.com/ Tel : (+1) (678) 954-0670 Direct : (+1) (678) 954-0671 Mobile : (+1) (706) 338-8599

1 0

problem returning a mapped LDAP attribute in EAP auths.
by Roberto S. G. 08 Aug '08

08 Aug '08

Hi, I'm migrating to FR2.0.5. After setting the new conf style, everything runs smooth and ok... but now I have a strange behavior: I have an attribute mapped in ldap.attrs file (as in FR1.1) but it's returned in the Access packet only in "clear" auths; with "EAP" auths, it is mapped (as -X shows), but it is not returned... Both sites-enabled/* files has the same conf: ldap uncommented in author. and authent. sections. Do I have to activate something more? Does the virtual_server configuration change returned attrs in some way? (different default modules activated)? Thanx for any suggestion.

2 1

PAP what password encryption is used?
by sphaero 08 Aug '08

08 Aug '08

Hello, I've been asked to setup freeradius to talk to a SQL Server database which contains users and passwords. This was not so much of a pain but I can't figure what password encryption is used. So I had hoped somebody with some more password encryption experience could shine a light here :) In the database I've set a password to 'testing' which results in the database as: DC724AF18FBDD4E59189F5FE768A5F8311527050 This looks like a SHA algorithm? I've browsed through the source code of the program that generates these password hashes. Indeed it uses SHA. This is the library they use: http://www.aspencrypt.com/object_context.html#CreateHash. They use the 'calgSHA'. But when I set the Password attribute in freeradius to SHA_password it doesn't match. It reads the database succesfully when I set User_password and use the hash as a password: radtest test(a)bla.com DC724AF18FBDD4E59189F5FE768A5F8311527050 localhost 0 testing123 Sending Access-Request of id 61 to 127.0.0.1 port 1812 User-Name = "test(a)bla.com" User-Password = "DC724AF18FBDD4E59189F5FE768A5F8311527050" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=61, length=43 Service-Type = Framed-User Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "132" But when I change User-Password to SHA-Password it doesn't match: radtest test(a)bla.com testing localhost 0 testing123 Sending Access-Request of id 131 to 127.0.0.1 port 1812 User-Name = "test(a)bla.com" User-Password = "testing" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Re-sending Access-Request of id 131 to 127.0.0.1 port 1812 User-Name = "test(a)bla.com" User-Password = "testing" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=131, length=20 So this isn't a SHA password hash? I don't know for sure if this the same encryption method but 'echo testing | openssl sha' generates a different hash: 581165b0cc90703a8e669d91effba108fbe2c83c Rg, Arnaud -- View this message in context: http://www.nabble.com/PAP-what-password-encryption-is-used--tp18887393p1888… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 4

Re: PAP what password encryption is used?
by sphaero 08 Aug '08

08 Aug '08

It seems it is SHA. I found in the output that freeradius couldn't determine the Auth-Type so rejected the user: auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user I've forced PAP by setting it in the users file for the realm: DEFAULT Realm == "bla.com", Autz-Type := bla, Auth-Type := PAP It works: rad_check_password: Found Auth-Type PAP auth: type "PAP" Processing the authenticate section of radiusd.conf modcall: entering group PAP for request 0 rlm_pap: login attempt with password testing rlm_pap: Using SHA1 encryption. rlm_pap: Normalizing SHA-Password from hex encoding rlm_pap: User authenticated successfully Great, now some good config practicing Thanks for all help :P Arnaud -- View this message in context: http://www.nabble.com/PAP-what-password-encryption-is-used--tp18887393p1888… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

php radius client (mount packet data)
by Alexandre J. Correa - Onda Internet 08 Aug '08

08 Aug '08

Hello !! Based on 'Pure PHP radius class' (http://developer.sysco.ch/php/) i´m trying to implement "disconnect-packet" like this command: echo "User-Name := xxxxxx" | radclient -x 111.222.333.444 disconnect <secret> freeradius recognizes that packet are "disconnect-request" but i think checksum of packet are incorrect, can someone look and try to discover the error ?! attached class, my changes are commented with //AlexandrE thanks !!! -- Sds. Alexandre Jeronimo Correa Onda Internet - http://www.ondainternet.com.br OPinguim Hosting - http://www.opinguim.net Linux User ID #142329 UNOTEL S/A - http://www.unotel.com.br

3 2

two types of auth on same freeradius
by Alexandre J. Correa - Onda Internet 08 Aug '08

08 Aug '08

Hello again :P how i can configure radius to auth users from my pppoe concentrators but auth MAC from my access-point too ... (for each type, i need change sql queries) !? or i need to run other copy of freeradius (different port and config) ?! thanks !!! regards, -- Sds. Alexandre Jeronimo Correa Onda Internet - http://www.ondainternet.com.br OPinguim Hosting - http://www.opinguim.net Linux User ID #142329 UNOTEL S/A - http://www.unotel.com.br

2 1

SQL module and Oracle Stored Procedures
by andreiv 08 Aug '08

08 Aug '08

Hi all, i have a question: is there a problem if instead of INSERT, SELECT or UPDATE I use Oracle stored procedures with FreeRadius 2.0.5? I haven't tested this because the procedure isn't ready yet. I searched the other posts and found similarities of my question only for FreeRadius 1.x.x which is configured differently. Thanks -- View this message in context: http://www.nabble.com/SQL-module-and-Oracle-Stored-Procedures-tp18887408p18… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

EAP-SIM and EAP-AKA fast-reauth support
by Geoffroy Arnoud 08 Aug '08

08 Aug '08

Hi all, I have a question about EAP-SIM and EAP-AKA authentication. Is fast-reauthentication supported (in eap or eap2 module)? Thanks in advance for your answers. Geoff. _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

3 3

Re: Login incorrect (Home Server says so)... - But why?
by uni＠christiankraus.de 08 Aug '08

08 Aug '08

well, problem is solved. The IP for the my realm was wrong. Now everything works without any problem

1 0