- Freeradius-Users - lists.freeradius.org

Re: about EAP using 1.1.7 and 2.0.3
by Ryan Setiawan H 09 Jul '08

09 Jul '08

Ryan Setiawan H wrote: > > Use 2.0.5. Or, install raddb/sites-available/inner-tunnel from the > >source tree. > > > > Alan DeKok. > > > Hi Alan, Thanks for the reply, I've Update to freeradius 2.0.5, but still didn't show result, the debug still the same, here are the debug : rad_recv: Access-Request packet from host 192.168.12.130 port 1024, id=27, length=213 Framed-MTU = 1480 NAS-IP-Address = 192.168.12.130 NAS-Identifier = "ProCurve Switch 2650" User-Name = "testing" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 1 NAS-Port-Type = Ethernet NAS-Port-Id = "1" Called-Station-Id = "00-1c-2e-73-85-00" Calling-Station-Id = "00-0a-e4-13-b8-87" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" EAP-Message = 0x0261000c0174657374696e67 Message-Authenticator = 0xf267668d55a632d7f6ff3b2b94735eca +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "testing", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 97 length 12 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound users: Matched entry testing at line 61 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 27 to 192.168.12.130 port 1024 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 1 NAS-Port-Type = Ethernet Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "101" EAP-Message = 0x016200160410706dc9d0aeae1c2c1fe2d41a5f8cc84a Message-Authenticator = 0x00000000000000000000000000000000 State = 0xba2a19f0ba481d03bf0d1926ffd8f60a Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.12.130 port 1024, id=27, length=213 Sending duplicate reply to client local port 1024 - ID: 27 Sending Access-Challenge of id 27 to 192.168.12.130 port 1024 Cleaning up request 0 ID 27 with timestamp +164 Ready to process requests. rad_recv: Access-Request packet from host 192.168.12.130 port 1024, id=27, length=213 Framed-MTU = 1480 NAS-IP-Address = 192.168.12.130 NAS-Identifier = "ProCurve Switch 2650" User-Name = "testing" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 1 NAS-Port-Type = Ethernet NAS-Port-Id = "1" Called-Station-Id = "00-1c-2e-73-85-00" Calling-Station-Id = "00-0a-e4-13-b8-87" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" EAP-Message = 0x0261000c0174657374696e67 Message-Authenticator = ------------------------------------------------------------------- I'm not sure it will help but i include the configure warning for 2.0.5 config.status: WARNING: ./Make.inc.in seems to ignore the --datarootdir setting config.status: WARNING: ./src/include/build-radpaths-h.in seems to ignore the --datarootdir setting chmod: check-radiusd-config: No such file or directory configure: WARNING: silently not building rlm_eap_ikev2. configure: WARNING: FAILURE: rlm_eap_ikev2 requires: libeap-ikev2 EAPIKEv2/connector.h. configure: WARNING: the TNCS library isn't found! configure: WARNING: silently not building rlm_eap_tnc. configure: WARNING: FAILURE: rlm_eap_tnc requires: -lTNCS. configure: WARNING: silently not building rlm_krb5. configure: WARNING: FAILURE: rlm_krb5 requires: krb5. configure: WARNING: silently not building rlm_sql_iodbc. configure: WARNING: FAILURE: rlm_sql_iodbc requires: libiodbc isql.h. configure: WARNING: silently not building rlm_sql_postgresql. configure: WARNING: FAILURE: rlm_sql_postgresql requires: libpq-fe.h libpq. configure: WARNING: oracle headers not found. Use --with-oracle-home-dir=<path>. configure: WARNING: silently not building rlm_sql_oracle. configure: WARNING: FAILURE: rlm_sql_oracle requires: oci.h. configure: WARNING: silently not building rlm_sql_unixodbc. configure: WARNING: FAILURE: rlm_sql_unixodbc requires: libodbc sql.h. --------------------------------------------------------------------- I'm using default configuration, just only change client.conf and users. there is clue, when I saw debug from 1.1.7 the second access request has different id but in this debug, it had same id ( that's is 27 ) maybe because client didn't receive challenge, it tried to retransmit I'm not expert at EAP but i think after challenge client should reply with different id... ( that is what I see at 1.1.7 ) Is there any configuration to be added ? Thank You Ryan Setiawan H -- DISCLAIMER: The contents of this email and attachments are confidential and may be subject to legal privilege. Any unauthorized use, copying, disclosure or communicating any part of it to others is strictly prohibited and may be unlawful. If you are not the intended recipient you must not use, copy, distribute or rely on this email and should please return it immediately to the sender or notify us and delete the email and any attachments from your system. We cannot accept liability for loss or damage resulting from computer viruses. The integrity of email across the Internet cannot be guaranteed and PT BANK NISP, Tbk. will not accept liability for any claims arising as a result of the use of this medium for transmissions by or to PT BANK NISP, Tbk.

3 2

proxy-to-realm versus using a suffix
by Chris Fruehwirth 09 Jul '08

09 Jul '08

Hello, FreeRADIUS version 2.0.4 I'm wonder what's the difference between using a suffix like @realmname versus using the proxy-to-realm in the users file. My current setup is testing using the XP supplicant using PEAP. I've already been able to terminate the PEAP connection and then proxy the MSCHAPV2 to the IAS server, but the behavior I get by doing this doesn't allow the XP client to popup the re-enter you credentials window after you change your password. So now I'm just trying to proxy the whole request through, which works using just the @realmname. But it doesn't working using the stanza entry with the proxy-to-realm in the users file. Any help would be appreciated. Thanks, Chris

3 9

about EAP using 1.1.7 and 2.0.3
by Ryan Setiawan H 09 Jul '08

09 Jul '08

Hi All, I've an issue about EAP in 802.1X. right now, I'm trying EAP-MD5 for 802.1X using freeradius 2.0.3 and procurve switch, sadly it doesn't work. but when I 'am using freeradius 1.1.7 it works smoothly .... I've tried not only using native windows XP SP 2 supplicant but also wpa_supplicant. both don't work using freeradius2. I've also tried reinstall the freeradius 2.0.3 ( i'm forget using mercurial ), I thought I misconfigure something..but. even using "fresh from the oven" configuration still just don't work. , here are the debug: Sending duplicate reply to client test port 1024 - ID: 4 Cleaning up request 2 ID 4 with timestamp +46 Ready to process requests. Framed-MTU = 1480 NAS-IP-Address = 192.168.12.130 NAS-Identifier = "ProCurve Switch 2650" User-Name = "testing" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 1 NAS-Port-Type = Ethernet NAS-Port-Id = "1" Called-Station-Id = "00-1c-2e-73-85-00" Calling-Station-Id = "00-0a-e4-13-58-c7" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" EAP-Message = 0x023a000c0174657374696e67 Message-Authenticator = 0x55d6fa8c198752bd6c62c351b234a57b +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "testing", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 58 length 12 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound users: Matched entry testing at line 102 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 2 NAS-Port-Type = Ethernet Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "101" EAP-Message = 0x013b001604101fee1ce904aea0659f790123de5bc761 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9e1dcf679e26cbc870b5fae6a11d133d Finished request 3. Going to the next request Waking up in 4.9 seconds. Sending duplicate reply to client test port 1024 - ID: 4 <--- any clue what is it ? Cleaning up request 3 ID 4 with timestamp +56 Ready to process requests. from the wpa_supplicant's debug it broke right before EAP message method, so it (the supplicant) doesn't receive any MD5 Challenge from radius. anyone have same problem? really appreciate for any help Thank you Ryan Setiawan H -- DISCLAIMER: The contents of this email and attachments are confidential and may be subject to legal privilege. Any unauthorized use, copying, disclosure or communicating any part of it to others is strictly prohibited and may be unlawful. If you are not the intended recipient you must not use, copy, distribute or rely on this email and should please return it immediately to the sender or notify us and delete the email and any attachments from your system. We cannot accept liability for loss or damage resulting from computer viruses. The integrity of email across the Internet cannot be guaranteed and PT BANK NISP, Tbk. will not accept liability for any claims arising as a result of the use of this medium for transmissions by or to PT BANK NISP, Tbk.

4 4

CHAP-Password does NOT match local User-Password
by Maciej Drobniuch 09 Jul '08

09 Jul '08

Hi everyone ! I'm a newbie in freeradius. I've tryied several freeradius versions, but i get always the same error: auth: user supplied CHAP-Password does NOT match local User-Password Currently i'm using freeradius 1.0.5 and i want to bind it with the pppoe-server(accounts are mysql based). This is the ppp auth part of the radiusd -X: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32772, id=50, length=90 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "qweqwe" CHAP-Password = 0x1a490e809284566aa959336e511314fe82 Calling-Station-Id = "00:04:61:5C:14:11" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/usr/local/var/log/radius/radacct/127.0.0.1/auth-detail-20080705' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/127.0.0.1/auth-detail-20080705 modcall[authorize]: module "auth_log" returns ok for request 0 radius_xlat: ':' rlm_attr_rewrite: No match found for attribute User-Name with value 'qweqwe' modcall[authorize]: module "dwukropki" returns ok for request 0 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "qweqwe", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 radius_xlat: 'qweqwe' rlm_sql (sql): sql_set_user escaped user --> 'qweqwe' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'qweqwe' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'qweqwe' ORDER BY id radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'qweqwe' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'qweqwe' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id radius_xlat: 'SELECT r.id,r.UserName,r.Attribute,inet_ntoa(n.ipaddr) as value,r.op ??FROM radreply as r, nodes as n WHERE r.Username = 'qweqwe' AND n.name=r.UserName ORDER BY r.id' rlm_sql_mysql: query: SELECT r.id,r.UserName,r.Attribute,inet_ntoa(n.ipaddr) as value,r.op ??FROM radreply as r, nodes as n WHERE r.Username = 'qweqwe' AND n.name=r.UserName ORDER BY r.id radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'qweqwe' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'qweqwe' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied CHAP-Password does NOT match local User-Password auth: Failed to validate the user. Login incorrect: [qweqwe] (from client localhost port 0 cli 00:04:61:5C:14:11) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 50 to 127.0.0.1:32772 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 50 with timestamp 486f753f Nothing to do. Sleeping until we see a request. Thanks for the support and sorry for my lame eng. -- ------------------------ Maciej Drobniuch

4 7

mod_auth_radius-2.0.c patch to support Apache 2.2.x
by Josip Rodin 08 Jul '08

08 Jul '08

Hi, I've tried sending this directly to the author, but there seems to be a problem somewhere, so I'm sending it to the list instead. Maybe I should file it as a bug report... This has been in the Debian package for a while now (http://packages.debian.org/libapache2-mod-auth-radius) ----- Forwarded message from Josip Rodin <joy(a)entuzijast.net> ----- Date: Sat, 31 May 2008 22:37:00 +0200 From: Josip Rodin <joy(a)entuzijast.net> To: Alan DeKok <aland(a)freeradius.org> Subject: mod_auth_radius-2.0.c patch to support Apache 2.2.x Hi, I'm resending the below e-mail just in case you didn't notice, it's been almost three months now. http://www.freeradius.org/mod_auth_radius/ is still only shipping the old versions... On Sun, Mar 09, 2008 at 09:12:19PM +0100, Josip Rodin wrote: > On Thu, Mar 06, 2008 at 03:36:27AM +0100, Josip Rodin wrote: > > On Sat, Jul 21, 2007 at 06:08:23PM +0200, joy wrote: > > > Is the mod_auth_radius-2.0.c supposed to work properly with Apache 2.2.x? > > > > > > I can compile it just fine, but can't get it to work on runtime. > > > > > > Maybe, like LDAP, this module should become a an AuthBasicProvider? > > > > I took a hint from mod_auth_xradius' changes for Apache 2.1+, and made the > > patch which is attached... but it still doesn't work. Apache is so annoying > > to debug, I need to compile the server with debugging symbols and run it > > through gdb... :( > > Okay, I debugged it a bit further (no help from gdb), and managed to produce > a working patch. The problem that threw me off was the early DECLINED > handling in the authenticate_basic_user() function, which got activated > both when the module was inactive and when the RADIUS server definition > was missing. However, these two conditions are functionally quite different, > so I split the handling in two, with the latter case leaving a warning > in the log file. > > The working patch is attached. It allows people to define: > AuthBasicProvider radius > and everything appears to be working well after that. > > -- > 2. That which causes joy or happiness. > --- libapache-mod-auth-radius-1.5.7.orig/mod_auth_radius-2.0.c > +++ libapache-mod-auth-radius-1.5.7/mod_auth_radius-2.0.c > @@ -300,6 +300,9 @@ > #include "apr_general.h" > #include "apr_tables.h" > #include "apr_strings.h" > +/* Apache 2.1+ */ > +#include "ap_provider.h" > +#include "mod_auth.h" > > module AP_MODULE_DECLARE_DATA radius_auth_module; > > @@ -1122,8 +1125,11 @@ > * basic authentication... > */ > > -static int > -authenticate_basic_user(request_rec *r) > +/* common stuff for both Apache 2.0 and 2.1+ */ > +int > +authenticate_basic_user_common(request_rec *r, > + const char* user, > + const char* sent_pw) > { > radius_dir_config_rec *rec = > (radius_dir_config_rec *)ap_get_module_config (r->per_dir_config, &radius_auth_module); > @@ -1131,21 +1137,25 @@ > radius_server_config_rec *scr = (radius_server_config_rec *) > ap_get_module_config (s->module_config, &radius_auth_module); > conn_rec *c = r->connection; > - const char *sent_pw; > char errstr[MAX_STRING_LEN]; > - int res, min; > + int min; > char *cookie; > char *state = NULL; > char message[256]; > time_t expires; > struct stat buf; > > - if (!rec->active || !scr->radius_ip) /* not active here, or no radius */ > - return DECLINED; /* server declared, decline */ > + /* not active here, just decline */ > + if (!rec->active) > + return DECLINED; > + > + /* no server declared, decline but note for debugging purposes -joy */ > + if (!scr->radius_ip) { > + ap_log_error(APLOG_MARK, APLOG_NOERRNO | APLOG_WARNING, 0, r->server, > + "AuthRadiusActive set, but no RADIUS server IP - missing AddRadiusAuth in this context?"); > + return DECLINED; > + } > > - if ((res = ap_get_basic_auth_pw(r, &sent_pw))) > - return res; > - > if (r->user[0] == 0) /* NUL users can never be let in */ > return HTTP_UNAUTHORIZED; > > @@ -1227,9 +1237,57 @@ > return OK; > } > > +/* Apache 2.1+ */ > +static authn_status > +authenticate_basic_user_newargs(request_rec *r, > + const char *user, > + const char *password) > +{ > + int normalreturnvalue = authenticate_basic_user_common(r, user, password); > + > + if (normalreturnvalue == OK) > + return AUTH_GRANTED; > + else if (normalreturnvalue == HTTP_UNAUTHORIZED) > + return AUTH_DENIED; > + else > + return AUTH_GENERAL_ERROR; > + /* AUTH_USER_NOT_FOUND would be nice, but the typical RADIUS server > + never gives any such information, it just sends an Access-Reject > + packet, no reasons given > + */ > +} > + > +/* Apache 2.0 */ > +static int > +authenticate_basic_user(request_rec *r) > +{ > + int res; > + const char *sent_pw; > + > + /* this used to say just if ((res=...)), which relied on the fact that > + OK is defined as 0, and the other states are non-0, which is then > + used in a typical C fashion... but it's a bad idea, really, we should > + explicitly check if it's not OK, whatever that may be -joy > + */ > + res = ap_get_basic_auth_pw(r, &sent_pw); > + if (res != OK) > + return res; > + > + return authenticate_basic_user_common(r, r->user, sent_pw); > +} > + > +/* Apache 2.1+ */ > +static const authn_provider authn_radius_provider = { > + &authenticate_basic_user_newargs, > + NULL > +}; > + > static void register_hooks(apr_pool_t *p) > { > - ap_hook_check_user_id(authenticate_basic_user,NULL,NULL,APR_HOOK_MIDDLE); > +/* Apache 2.1+ */ > + static const char * const aszPost[]={ "mod_authz_user.c", NULL }; > + ap_register_provider(p, AUTHN_PROVIDER_GROUP, "radius", "0", &authn_radius_provider); > + ap_hook_check_user_id(authenticate_basic_user,NULL,aszPost,APR_HOOK_MIDDLE); > } > > module AP_MODULE_DECLARE_DATA radius_auth_module = -- 2. That which causes joy or happiness. ----- End forwarded message -----

1 0

ASSERT FAILED
by Norbert Wegener 08 Jul '08

08 Jul '08

As snmp is not available right now, I am looking in how to deal with statistics, status_server and played a bit. This way I was able to kill freeradius... First I noticed: radclient: dict_init: /usr/share/freeradius//dictionary.freeradius[47]: dict_addattr: attribute name too long I commented out a few of the long-named values. Now with cat x | radclient -d /usr/share/freeradius/ 127.0.0.1 status adminsecret, where x contains: Message-Authenticator = 0x00 FreeRADIUS-Statistics-Type=1 I got: rad_recv: Status-Server packet from host 127.0.0.1 port 33453, id=117, length=50 Message-Authenticator = 0x32f28212809676b99d5943988a714aa8 FreeRADIUS-Statistics-Type = Authentication ASSERT FAILED stats.c[318]: request->listener->type == RAD_LISTEN_NONE Abgebrochen Norbert Wegener

3 4

FR on CentOS 5 via yum?
by AlexDreadd 08 Jul '08

08 Jul '08

I've tried doing a yum install of freeRadius on a centos 5 machine, but the latest version I could get was 1.1.3, which is no longer supported, and doesn't work properly for my needs. FR 1.1.3 with mysql 5 gives me these errors: Error: rlm_sql (sql): stop packet with zero session length. Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 So I was hoping that updating might fix this problem, only to find that I can't seem to find an update for my machine. If not via yum, at least is there a repo or RPM for getting it on the CentOS? -Alex -- View this message in context: http://www.nabble.com/FR-on-CentOS-5-via-yum--tp18242950p18242950.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 4

virtual server and clients from sql
by Norbert Wegener 08 Jul '08

08 Jul '08

With the actual git/cvs I wanted to setup client based virtual Servers, where the clients are stored in a mysql database. I added a column "server" to the nas table and set it to the name of a virtual server. ... rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret FROM nas^M rlm_sql (sql): Reserving sql socket id: 4^M rlm_sql (sql): Read entry nasname=149.246.222.54,shortname=149.246.222.541,secret=testing123^M rlm_sql (sql): Adding client 149.246.222.54 (149.246.222.541, server=<none>) to clients list^M ... It seems, the value for server is ignored. Maybe the SELECT statement in rlm_sql.c has to be modified? Or do I have to configure anything else? Thanks Norbert Wegener

4 10

radius user disconnection and same account multiplication problem in radacct
by tg_melo＠bol.com.br 08 Jul '08

08 Jul '08

A new doubt. Is there anyway to safe disconnet an user from the radius server, in a way that it auto disconnects him from the nas (a pppoe server)? And about that Packet of Disconnect, is it still working? I forgot to cite the version I'm using, and considering the message was sent on weekend, with less chance of reading, I'm replying it. If I'm doing wrong, I apologize, but I still trust in your experience to provide me with some ideas. I'm using all the last stuff (Freeradius 2.0.3) from the ports repository on a FreeBSD 6.3. The server is an ISP in production and we have to restart the connection suit (pppoe, radius, firewall) everytime some account starts to multiply itself, so the users that are multiplying can log in again, and not receive the message 'Still logged in' . I'll be realy grateful for any reply. Thanks Again. >Hi again, I solved the last trouble with ippool.db using the sqlippool instead. >But I got a new shining problem. :) >Now, almost everything seems to be working fine. Almost, cause I have some account >multiplication in the radacct table. Only a few users are doing that. And the multiplication >doesn't stop while the users remain logged on. Only a few appear in table, I'm using an unique >index with acctstarttime and nasipaddress. And the numbers of radacctid jump a lot (from 1400 >to 4000, for example). >I'm using also the set rad_alive 40 in ppp.conf and in the radiusd.conf, cleanup_delay 8 and >max_request_time 50. All that with chap authentication. >Select on one of the users who get the problem: +-----------+----------------------------------+--------------+--------------------+-----------+-------+----------------+------- ----+-------------+---------------------+--------------+-----------------+---------------+-------------------+------------------ +-----------------+------------------+-----------------+------------------+--------------------+-------------+----------------+- ----------------+----------------+---------------+----------------------+ | radacctid | acctsessionid | acctuniqueid | username | groupname | realm | nasipaddress | naspor tid | nasporttype | acctstarttime | acctstoptime | acctsessiontime | acctauthentic | connectinfo_start | connectinfo_stop | acctinputoctets | acctoutputoctets | calledstationid | callingstationid | acctterminatecause | servicetype | framedprotocol | framedipaddress | acctstartdelay | acctstopdelay | xascendsessionsvrkey | +-----------+----------------------------------+--------------+--------------------+-----------+-------+----------------+------- ----+-------------+---------------------+--------------+-----------------+---------------+-------------------+------------------ +-----------------+------------------+-----------------+------------------+--------------------+-------------+----------------+- ----------------+----------------+---------------+----------------------+ | 14419 | 37142-user212151719 | | user2 | | | XXX.XXX.XXX.252 | 688 | Ethernet | 2008-07-04 08:46:31 | NULL | 0 | | | | 0 | 0 | | X | | Framed-User | PPP | XXX.XXX.XXX.182 | 0 | 0 | | | 14421 | 37142-user212151719 | | user2 | | | XXX.XXX.XXX.252 | 688 | Ethernet | 2008-07-04 08:46:34 | NULL | 40 | | | NULL | 31795 | 102873 | | X | | Framed-User | PPP | XXX.XXX.XXX.182 | 0 | NULL | | | 14424 | 37142-user212151719 | | user2 | | | XXX.XXX.XXX.252 | 688 | Ethernet | 2008-07-04 08:46:37 | NULL | 80 | | | NULL | 59226 | 215383 | | X | | Framed-User | PPP | XXX.XXX.XXX.182 | 0 | NULL | | +-----------+----------------------------------+--------------+--------------------+-----------+-------+----------------+------- ----+-------------+---------------------+--------------+-----------------+---------------+-------------------+------------------ +-----------------+------------------+-----------------+------------------+--------------------+-------------+----------------+- ----------------+----------------+---------------+----------------------+ >Radius log exact when the problem starts: 74242 Fri Jul 4 03:40:25 2008 : Info: Ready to process requests. 74243 Fri Jul 4 03:41:02 2008 : Info: Allocated IP: XXX.XXX.XXX.121 from valid (did cli 0 port 678 user x) 74244 Fri Jul 4 03:41:10 2008 : Info: Allocated IP: XXX.XXX.XXX.179 from valid (did cli 0 port 679 user x) 74245 Fri Jul 4 04:40:00 2008 : Info: Allocated IP: XXX.XXX.XXX.186 from valid (did cli 0 port 680 user x) 74246 Fri Jul 4 06:37:33 2008 : Info: Allocated IP: XXX.XXX.XXX.67 from valid (did cli 0 port 681 user x) 74247 Fri Jul 4 06:57:05 2008 : Info: Released IP XXX.XXX.XXX.67 (did cli 0 user x) 74248 Fri Jul 4 07:01:50 2008 : Info: Allocated IP: XXX.XXX.XXX.153 from valid (did cli 0 port 682 user x) 74249 Fri Jul 4 07:07:34 2008 : Info: Allocated IP: XXX.XXX.XXX.105 from valid (did cli 0 port 683 user x) 74250 Fri Jul 4 07:29:44 2008 : Info: Released IP XXX.XXX.XXX.186 (did cli 0 user x) 74251 Fri Jul 4 07:33:22 2008 : Info: Allocated IP: XXX.XXX.XXX.141 from valid (did cli 0 port 684 user x) 74252 Fri Jul 4 08:06:53 2008 : Info: Allocated IP: XXX.XXX.XXX.133 from valid (did cli 0 port 685 user x) 74253 Fri Jul 4 08:07:54 2008 : Info: Allocated IP: XXX.XXX.XXX.139 from valid (did cli 0 port 686 user x) 74254 Fri Jul 4 08:34:12 2008 : Info: Allocated IP: XXX.XXX.XXX.173 from valid (did cli 0 port 687 user x) 74255 Fri Jul 4 08:35:02 2008 : Info: Released IP XXX.XXX.XXX.133 (did cli 0 user x) 74256 Fri Jul 4 08:46:31 2008 : Info: Allocated IP: XXX.XXX.XXX.182 from valid (did cli 0 port 688 user user2) 74257 Fri Jul 4 08:47:11 2008 : Error: rlm_sql (sql): Couldn't insert SQL accounting ALIVE record - Duplicate entry '2008-07-0 08:46:31-XXX.XXX.XXX.252' for key 'radacct_whoson' 74258 Fri Jul 4 08:47:11 2008 : Error: rlm_sql_mysql: Cannot store result 74259 Fri Jul 4 08:47:11 2008 : Error: rlm_sql_mysql: MySQL error 'Duplicate entry '2008-07-04 08:46:31-XXX.XXX.XXX.252' for ke 'radacct_whoson'' 74260 Fri Jul 4 08:47:11 2008 : Error: rlm_sql_mysql: Cannot store result 74261 Fri Jul 4 08:47:11 2008 : Error: rlm_sql_mysql: MySQL error 'Duplicate entry '2008-07-04 08:46:31-XXX.XXX.XXX.252' for ke 'radacct_whoson'' 74262 Fri Jul 4 08:47:51 2008 : Error: rlm_sql (sql): Couldn't insert SQL accounting ALIVE record - Duplicate entry '2008-07-0 08:46:31-XXX.XXX.XXX.252' for key 'radacct_whoson' 74263 Fri Jul 4 08:47:51 2008 : Error: rlm_sql_mysql: Cannot store result >And a tcpdump: Accounting Response (5), id: 0xb5, Authenticator: 3cffa31d3a8dd380caf25ceb110aca6c 08:46:27.957730 IP (tos 0x0, ttl 64, id 34131, offset 0, flags [none], proto: UDP (17), length: 239) XXX.XXX.XXX.129.62577 > XXX XXX.XXX.XXX.129.1813: RADIUS, length: 211 Accounting Request (4), id: 0xce, Authenticator: 886040c74f1443cacfbed17841589bd9 Username Attribute (1), length: 14, Value: user1 0x0000: X Service Type Attribute (6), length: 6, Value: Framed 0x0000: 0000 0002 Framed Protocol Attribute (7), length: 6, Value: PPP 0x0000: 0000 0001 Framed IP Address Attribute (8), length: 6, Value: XXX.XXX.XXX.141 0x0000: X Framed IP Network Attribute (9), length: 6, Value: 0.0.0.0 0x0000: 0000 0000 Calling Station Attribute (31), length: 17, Value: [|radius] 0x0000: X [|radius] 08:46:27.962438 IP (tos 0x0, ttl 64, id 34132, offset 0, flags [none], proto: UDP (17), length: 48) XXX.XXX.XXX.129.1813 > XXX. XXX.XXX.129.62577: [udp sum ok] RADIUS, length: 20 Accounting Response (5), id: 0xce, Authenticator: ffaf38da2a70212e3ce78afd032a525e 08:46:31.454218 IP (tos 0x0, ttl 64, id 34133, offset 0, flags [none], proto: UDP (17), length: 183) XXX.XXX.XXX.129.58869 > XXX .4XXX.XXX.129.1812: RADIUS, length: 155 Access Request (1), id: 0x1d, Authenticator: e44b21c5e2e38c76f6a119d317a157f5 Username Attribute (1), length: 20, Value: user2 0x0000: X 0x0010: 6e6f Service Type Attribute (6), length: 6, Value: Framed 0x0000: 0000 0002 Framed Protocol Attribute (7), length: 6, Value: PPP 0x0000: 0000 0001 CHAP Password Attribute (3), length: 19, Value: 0x0000: X [|radius] 08:46:31.459805 IP (tos 0x0, ttl 64, id 34134, offset 0, flags [none], proto: UDP (17), length: 63) XXX.XXX.XXX.129.1812 > XXX. XXX.XXX.129.58869: [udp sum ok] RADIUS, length: 35 Access Accept (2), id: 0x1d, Authenticator: c824b98efd857da27fa51a00998c3524 Filter ID Attribute (11), length: 9, Value: d256u96 0x0000: 6432 3536 7539 36 Framed IP Address Attribute (8), length: 6, Value: XXX.XXX.XXX.182 0x0000: X 08:46:31.482694 IP (tos 0x0, ttl 64, id 34135, offset 0, flags [none], proto: UDP (17), length: 208) XXX.XXX.XXX.129.60184 > XXX .XXX.XXX.129.1813: RADIUS, length: 180 Accounting Request (4), id: 0xc0, Authenticator: 0b59529ee5d6890d7c8800178b3566de Username Attribute (1), length: 20, Value: user2 0x0000: X 0x0010: 6e6f Service Type Attribute (6), length: 6, Value: Framed 0x0000: 0000 0002 Framed Protocol Attribute (7), length: 6, Value: PPP 0x0000: 0000 0001 Framed IP Address Attribute (8), length: 6, Value: XXX.XXX.XXX.182 0x0000: X Framed IP Network Attribute (9), length: 6, Value: 0.0.0.0 0x0000: 0000 0000 [|radius] 08:46:31.487710 IP (tos 0x0, ttl 64, id 34136, offset 0, flags [none], proto: UDP (17), length: 48) XXX.XXX.XXX.129.1813 > XXX. XXX.XXX.129.60184: [udp sum ok] RADIUS, length: 20 Accounting Response (5), id: 0xc0, Authenticator: 399a20995afe01833bba61fb036795cf 08:46:34.244683 IP (tos 0x0, ttl 64, id 34143, offset 0, flags [none], proto: UDP (17), length: 72) XXX.XXX.XXX.129.50747 > XXX. 4XXX.XXX.129.53: [udp sum ok] 46949+ A? dnl-us7.kaspersky-labs.com. (44) 08:46:34.244836 IP (tos 0x0, ttl 64, id 34144, offset 0, flags [none], proto: UDP (17), length: 88) XXX.XXX.XXX.129.53 > XXX.8. 244.129.50747: [udp sum ok] 46949 q: A? dnl-us7.kaspersky-labs.com. 1/0/0 dnl-us7.kaspersky-labs.com. A 195.200.84.5 (60) 08:46:34.955698 IP (tos 0x0, ttl 64, id 34154, offset 0, flags [none], proto: UDP (17), length: 64) XXX.XXX.XXX.129.50747 > XXX. 4XXX.XXX.129.53: [udp sum ok] 249+ A? www.aresgalaxy.org. (36) 08:46:34.955849 IP (tos 0x0, ttl 64, id 34155, offset 0, flags [none], proto: UDP (17), length: 80) XXX.XXX.XXX.129.53 > XXX.8. 244.129.50747: [udp sum ok] 249 q: A? www.aresgalaxy.org. 1/0/0 www.aresgalaxy.org. A 66.98.222.3 (52) 08:46:48.279695 IP (tos 0x0, ttl 64, id 34183, offset 0, flags [none], proto: UDP (17), length: 247) XXX.XXX.XXX.129.55465 > XXX .XXX.XXX.129.1813: RADIUS, length: 219 Accounting Request (4), id: 0x8f, Authenticator: 12a34e1ff6be327bea5bf73a03a635af Username Attribute (1), length: 18, Value: user1 0x0000: X Service Type Attribute (6), length: 6, Value: Framed 0x0000: 0000 0002 Framed Protocol Attribute (7), length: 6, Value: PPP 0x0000: 0000 0001 Framed IP Address Attribute (8), length: 6, Value: XXX.XXX.XXX.139 0x0000: X Framed IP Network Attribute (9), length: 6, Value: 0.0.0.0 0x0000: 0000 0000 Calling Station Attribute (31), length: 17, Value: [|radius] [|radius] 08:46:48.284459 IP (tos 0x0, ttl 64, id 34184, offset 0, flags [none], proto: UDP (17), length: 48) XXX.XXX.XXX.129.1813 > XXX. XXX.XXX.129.55465: [udp sum ok] RADIUS, length: 20 Accounting Response (5), id: 0x8f, Authenticator: 2f2339fd34188a81f2d0a707623d217f 08:46:48.446680 IP (tos 0x0, ttl 64, id 34187, offset 0, flags [none], proto: UDP (17), length: 61) XXX.XXX.XXX.129.50747 > XXX. 4XXX.XXX.129.53: [udp sum ok] 14077+ A? lan.startvg.com. (33) 08:46:48.446823 IP (tos 0x0, ttl 64, id 34188, offset 0, flags [none], proto: UDP (17), length: 77) XXX.XXX.XXX.129.53 > XXX.8. 244.129.50747: [udp sum ok] 14077 q: A? lan.startvg.com. 1/0/0 lan.startvg.com. A 74.55.200.146 (49) 08:46:49.446681 IP (tos 0x0, ttl 64, id 34200, offset 0, flags [none], proto: UDP (17), length: 60) XXX.XXX.XXX.129.50747 > XXX. 4XXX.XXX.129.53: [udp sum ok] 12455+ A? w5.startvg.com. (32) 08:46:49.446865 IP (tos 0x0, ttl 64, id 34201, offset 0, flags [none], proto: UDP (17), length: 76) XXX.XXX.XXX.129.53 > XXX.8. 244.129.50747: [udp sum ok] 12455 q: A? w5.startvg.com. 1/0/0 w5.startvg.com. A 70.85.138.50 (48) 08:46:49.786702 IP (tos 0x0, ttl 64, id 34206, offset 0, flags [none], proto: UDP (17), length: 239) XXX.XXX.XXX.129.51839 > XXX .XXX.XXX.129.1813: RADIUS, length: 211 Accounting Request (4), id: 0xb4, Authenticator: 3c8be7fa69dbb6607353d2ee04ab65f6 Username Attribute (1), length: 14, Value: user3 0x0000: X Service Type Attribute (6), length: 6, Value: Framed 0x0000: 0000 0002 Framed Protocol Attribute (7), length: 6, Value: PPP 0x0000: 0000 0001 Framed IP Address Attribute (8), length: 6, Value: XXX.XXX.XXX.105 0x0000: X Framed IP Network Attribute (9), length: 6, Value: 0.0.0.0 0x0000: 0000 0000 Calling Station Attribute (31), length: 17, Value: [|radius] 0x0000: X [|radius] 08:46:49.791404 IP (tos 0x0, ttl 64, id 34207, offset 0, flags [none], proto: UDP (17), length: 48) XXX.XXX.XXX.129.1813 > XXX. XXX.XXX.129.51839: [udp sum ok] RADIUS, length: 20 Accounting Response (5), id: 0xb4, Authenticator: 2da35067aa3748f5f755e398f15b4139 08:46:50.629687 IP (tos 0x0, ttl 64, id 34234, offset 0, flags [none], proto: UDP (17), length: 63) XXX.XXX.XXX.129.50747 > XXX. 4XXX.XXX.129.53: [udp sum ok] 20104+ A? www.google.com.br. (35) 08:46:50.629850 IP (tos 0x0, ttl 64, id 34235, offset 0, flags [none], proto: UDP (17), length: 159) XXX.XXX.XXX.129.53 > XXX.8 .244.129.50747: 20104 q: A? www.google.com.br. 5/0/0 www.google.com.br. CNAME www.google.com., [|domain] 08:46:50.874678 IP (tos 0x0, ttl 64, id 34249, offset 0, flags [none], proto: UDP (17), length: 75) XXX.XXX.XXX.129.50747 > XXX. 4XXX.XXX.129.53: [udp sum ok] 38539+ A? pagead2.googlesyndication.com. (47) 08:46:50.874849 IP (tos 0x0, ttl 64, id 34250, offset 0, flags [none], proto: UDP (17), length: 153) XXX.XXX.XXX.129.53 > XXX.8 .244.129.50747: 38539 q: A? pagead2.googlesyndication.com. 4/0/0 pagead2.googlesyndication.com. CNAME[|domain] 08:46:52.001649 IP (tos 0x0, ttl 64, id 34258, offset 0, flags [none], proto: UDP (17), length: 231) XXX.XXX.XXX.129.59355 > XXX .XXX.XXX.129.1813: RADIUS, length: 203 Accounting Request (4), id: 0xdf, Authenticator: 8e381d93036159faf44668b400403a9f Username Attribute (1), length: 10, Value: user4 0x0000: X Service Type Attribute (6), length: 6, Value: Framed 0x0000: 0000 0002 Framed Protocol Attribute (7), length: 6, Value: PPP 0x0000: 0000 0001 Framed IP Address Attribute (8), length: 6, Value: XXX.XXX.XXX.121 0x0000: X Framed IP Network Attribute (9), length: 6, Value: 0.0.0.0 0x0000: 0000 0000 Calling Station Attribute (31), length: 17, Value: [|radius] 0x0000: X [|radius] 08:46:52.006180 IP (tos 0x0, ttl 64, id 34259, offset 0, flags [none], proto: UDP (17), length: 48) XXX.XXX.XXX.129.1813 > XXX. XXX.XXX.129.59355: [udp sum ok] RADIUS, length: 20 Accounting Response (5), id: 0xdf, Authenticator: 71076d45f47f02944419c017c1408092 08:46:57.031248 IP (tos 0x0, ttl 64, id 34383, offset 0, flags [none], proto: UDP (17), length: 242) XXX.XXX.XXX.129.52499 > XXX .XXX.XXX.129.1813: RADIUS, length: 214 Accounting Request (4), id: 0x8b, Authenticator: 308ab2eea576048c9a8ab051ffdb2938 Username Attribute (1), length: 15, Value: user5 0x0000: X Service Type Attribute (6), length: 6, Value: Framed 0x0000: 0000 0002 Framed Protocol Attribute (7), length: 6, Value: PPP 0x0000: 0000 0001 Framed IP Address Attribute (8), length: 6, Value: XXX.XXX.XXX.173 0x0000: X Framed IP Network Attribute (9), length: 6, Value: 0.0.0.0 0x0000: 0000 0000 Calling Station Attribute (31), length: 18, Value: [|radius] 0x0000: X [|radius] 08:46:57.035743 IP (tos 0x0, ttl 64, id 34384, offset 0, flags [none], proto: UDP (17), length: 48) XXX.XXX.XXX.129.1813 > XXX. XXX.XXX.129.52499: [udp sum ok] RADIUS, length: 20 Accounting Response (5), id: 0x8b, Authenticator: b5966fd9dcda6cc7461c48b97d2bec15 08:46:59.532790 IP (tos 0x0, ttl 64, id 34395, offset 0, flags [none], proto: UDP (17), length: 243) XXX.XXX.XXX.129.58045 > XXX .XXX.XXX.129.1813: RADIUS, length: 215 Accounting Request (4), id: 0x5c, Authenticator: 4d6cb1252ea0b5762d34bbc841a3f9ed Username Attribute (1), length: 16, Value: user6 0x0000: X Service Type Attribute (6), length: 6, Value: Framed 0x0000: 0000 0002 Framed Protocol Attribute (7), length: 6, Value: PPP 0x0000: 0000 0001 Framed IP Address Attribute (8), length: 6, Value: XXX.XXX.XXX.179 0x0000: X Framed IP Network Attribute (9), length: 6, Value: 0.0.0.0 0x0000: 0000 0000 Calling Station Attribute (31), length: 17, Value: [|radius] 0x0000: X [|radius] 08:46:59.554103 IP (tos 0x0, ttl 64, id 34396, offset 0, flags [none], proto: UDP (17), length: 48) XXX.XXX.XXX.129.1813 > XXX. XXX.XXX.129.58045: [udp sum ok] RADIUS, length: 20 Accounting Response (5), id: 0x5c, Authenticator: 7432260fa37dae970c78198a9e5e923a 08:47:07.580791 IP (tos 0x0, ttl 64, id 34407, offset 0, flags [none], proto: UDP (17), length: 233) XXX.XXX.XXX.129.60644 > XXX .XXX.XXX.129.1813: RADIUS, length: 205 Accounting Request (4), id: 0x4f, Authenticator: 0a9617838fba04faad448c44d06d71b6 Username Attribute (1), length: 11, Value: user7 0x0000: X Service Type Attribute (6), length: 6, Value: Framed 0x0000: 0000 0002 Framed Protocol Attribute (7), length: 6, Value: PPP 0x0000: 0000 0001 Framed IP Address Attribute (8), length: 6, Value: XXX.XXX.XXX.153 0x0000: X Framed IP Network Attribute (9), length: 6, Value: 0.0.0.0 0x0000: 0000 0000 Calling Station Attribute (31), length: 17, Value: [|radius] 0x0000: X [|radius] 08:47:07.585498 IP (tos 0x0, ttl 64, id 34408, offset 0, flags [none], proto: UDP (17), length: 48) XXX.XXX.XXX.129.1813 > XXX. XXX.XXX.129.60644: [udp sum ok] RADIUS, length: 20 Accounting Response (5), id: 0x4f, Authenticator: 2fa9d8161b441a9f5336f630fe55e9fa 08:47:08.197706 IP (tos 0x0, ttl 64, id 34409, offset 0, flags [none], proto: UDP (17), length: 239) XXX.XXX.XXX.129.63164 > XXX .XXX.XXX.129.1813: RADIUS, length: 211 Accounting Request (4), id: 0xb2, Authenticator: 2fe5ce8331e665ebbea87ec953075c2d Username Attribute (1), length: 14, Value: user1 0x0000: X Service Type Attribute (6), length: 6, Value: Framed 0x0000: 0000 0002 Framed Protocol Attribute (7), length: 6, Value: PPP 0x0000: 0000 0001 Framed IP Address Attribute (8), length: 6, Value: XXX.XXX.XXX.141 0x0000: X Framed IP Network Attribute (9), length: 6, Value: 0.0.0.0 0x0000: 0000 0000 Calling Station Attribute (31), length: 17, Value: [|radius] 0x0000: X [|radius] 08:47:08.202234 IP (tos 0x0, ttl 64, id 34410, offset 0, flags [none], proto: UDP (17), length: 48) XXX.XXX.XXX.129.1813 > XXX. XXX.XXX.129.63164: [udp sum ok] RADIUS, length: 20 Accounting Response (5), id: 0xb2, Authenticator: 9308c51e608c6503d0ed826ca179d817 08:47:09.428670 IP (tos 0x0, ttl 64, id 34412, offset 0, flags [none], proto: UDP (17), length: 59) XXX.XXX.XXX.129.50747 > XXX. 4XXX.XXX.129.53: [udp sum ok] 62382+ A? www.orkut.com. (31) 08:47:09.428851 IP (tos 0x0, ttl 64, id 34413, offset 0, flags [none], proto: UDP (17), length: 152) XXX.XXX.XXX.129.53 > XXX.8 .244.129.50747: 62382 q: A? www.orkut.com. 5/0/0 www.orkut.com. CNAME orkut.l.google.com., orkut.l.google.com.[|domain] 08:47:11.705737 IP (tos 0x0, ttl 64, id 34427, offset 0, flags [none], proto: UDP (17), length: 250) XXX.XXX.XXX.129.54776 > XXX .XXX.XXX.129.1813: RADIUS, length: 222 Accounting Request (4), id: 0x9e, Authenticator: f46cb516f565b2533b8f797708c04f41 Username Attribute (1), length: 20, Value: user2 0x0000: X 0x0010: 6e6f Service Type Attribute (6), length: 6, Value: Framed 0x0000: 0000 0002 Framed Protocol Attribute (7), length: 6, Value: PPP 0x0000: 0000 0001 Framed IP Address Attribute (8), length: 6, Value: XXX.XXX.XXX.182 0x0000: X Framed IP Network Attribute (9), length: 6, Value: 0.0.0.0 0x0000: 0000 0000 [|radius] 08:47:14.722579 IP (tos 0x0, ttl 64, id 34462, offset 0, flags [none], proto: UDP (17), length: 250) XXX.XXX.XXX.129.54776 > XXX .XXX.XXX.129.1813: RADIUS, length: 222 Accounting Request (4), id: 0x9e, Authenticator: f46cb516f565b2533b8f797708c04f41 Username Attribute (1), length: 20, Value: user2 0x0000: X 0x0010: 6e6f Service Type Attribute (6), length: 6, Value: Framed 0x0000: 0000 0002 Framed Protocol Attribute (7), length: 6, Value: PPP 0x0000: 0000 0001 Framed IP Address Attribute (8), length: 6, Value: XXX.XXX.XXX.182 0x0000: X Framed IP Network Attribute (9), length: 6, Value: 0.0.0.0 0x0000: 0000 0000 [|radius] 08:47:14.727705 IP (tos 0x0, ttl 64, id 34463, offset 0, flags [none], proto: UDP (17), length: 48) XXX.XXX.XXX.129.1813 > XXX. XXX.XXX.129.54776: [udp sum ok] RADIUS, length: 20 Accounting Response (5), id: 0x9e, Authenticator: 2b5bbecd09941fda409322375fac86f5 08:47:28.519682 IP (tos 0x0, ttl 64, id 34515, offset 0, flags [none], proto: UDP (17), length: 247) XXX.XXX.XXX.129.51199 > XXX .XXX.XXX.129.1813: RADIUS, length: 219 Accounting Request (4), id: 0xc3, Authenticator: 1eacbab964455ecd42ae9251d6eeaee0 Username Attribute (1), length: 18, Value: user3 0x0000: X Service Type Attribute (6), length: 6, Value: Framed >The ppp.log keeps on "Radius: Request re-sent" for that user. >I'm trying to solve that for days, without success. Anything I tried to stop that multiple >accounts doesn't help. >So any help, like always, will be appreciated. >Thanks in advance.

2 1

EAP/peap: MSCHAP Success
by db7td＠gmx.de 07 Jul '08

07 Jul '08

Hello, I have some problems with freeradius 2.0.5 and ntlm_auth: ntlm_auth seems to authenticate successful, but freeradius is sending another access-challenge istead of access-accept. Finally, authentication fails. Any ideas? Thanks, Dietmar rad_recv: Access-Request packet from host x.x.x.x port 32770, id=29, length=323 User-Name = "xxxx" Calling-Station-Id = "00-aa-aa-aa-aa-aa" Called-Station-Id = "bb-bb-bb-bb-bb-bb:abcd" NAS-Port = 29 NAS-IP-Address = x.x.x.x NAS-Identifier = "xxxx" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "111" EAP-Message = 0x020800901900170301002068300aa7af68cd11d993c8573581cfda02004335dd25b185c1caa58932f2c445170301006099a8478aa1f46aaee96b7280da1a3112f767ad35f728c5011d8328935379ce01eaf5a2b8bacd04a3ff66b08517d524b80e09809b94ae7720e5de155cb5d9ef20ffbd207bef659afb95d25c15b9898b401ff7eac15cd25109681c5150b976c6bc State = 0x7641829c70499b7e3361ddd3f9666230 Message-Authenticator = 0xc43073f681146021f4c82a9d2d1ce165 +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_realm: No '@' in User-Name = "xxxx", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 8 length 144 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 PEAP: Setting User-Name to yyyy\xxxx +- entering group authorize ++[preprocess] returns ok ++[mschap] returns noop rlm_realm: No '@' in User-Name = "yyyy\xxxx", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 8 length 73 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated users: Matched entry DEFAULT at line 1 users: Matched entry DEFAULT at line 460 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 +- entering group MS-CHAP rlm_mschap: No Cleartext-Password configured. Cannot create LM-Password. rlm_mschap: No Cleartext-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for xxxx with NT-Password expand: --domain=%{mschap:NT-Domain} -> --domain=yyyyyy expand: --username=%{mschap:User-Name:-None} -> --username=xxxx mschap2: b0 expand: --challenge=%{mschap:Challenge:-00} -> --challenge=8fc3f2bd3e12c979 expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=9c59f2bc45acacb2fe7b4068cb014b9aed12664f7135d064 Exec-Program output: NT_KEY: 09360732CEED74278E86C2D9A9EBB694 Exec-Program-Wait: plaintext: NT_KEY: 09360732CEED74278E86C2D9A9EBB694 Exec-Program: returned: 0 rlm_mschap: adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success ++[eap] returns handled PEAP: Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 29 to x.x.x.x port 32770 EAP-Message = 0x0109005b190017030100508b5c946b956210b83f4d4dc1110d22be38775b1fab7e98154dc59571b3e81b6d2f4c06139ebfbaeae78d6b41cd6ef643f1a67d56b96bf669bbb0aab6e6df36281122e5b85d6a1543990e7cd0d61523ed Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7641829c71489b7e3361ddd3f9666230 Finished request 17.

2 4