- Freeradius-Users - lists.freeradius.org

Strange behaviour of a NAS
by Michael Schwartzkopff 18 Jun '08

18 Jun '08

Hi list, We see a strange behaviour of a NAS. It sometimes sens out double accouting requests. See tcpdump below. Between the two packets there is a time difference of 40 microseconds(!) Has anybody a good explanation for this behaviour of the NAS? Any other theory? Misconfiguration? NAS type: Alcatel SMC. Thanks for any hint. --- dump --- 17:19:35.903233 IP xxx.206.254.10.17188 > xxx.217.246.173.1813: RADIUS, Accounting Request (4), id: 0x9b length: 362 17:19:35.903275 IP xxx.206.254.10.17188 > xxx.217.246.173.1813: RADIUS, Accounting Request (4), id: 0x9b length: 362 17:19:35.904208 IP xxx.217.246.173.1813 > xxx.206.254.10.17188: RADIUS, Accounting Response (5), id: 0x9b length: 20 These two incomming packets are really identical. Even if you look closer with -v option of tcpdump. Same authenticator. --- -- Dr. Michael Schwartzkopff MultiNET Services GmbH Addresse: Bretonischer Ring 7; 85630 Grasbrunn; Germany Tel: +49 - 89 - 45 69 11 0 Fax: +49 - 89 - 45 69 11 21 mob: +49 - 174 - 343 28 75 mail: misch(a)multinet.de web: www.multinet.de Sitz der Gesellschaft: 85630 Grasbrunn Registergericht: Amtsgericht München HRB 114375 Geschäftsführer: Günter Jurgeneit, Hubert Martens --- PGP Fingerprint: F919 3919 FF12 ED5A 2801 DEA6 AA77 57A4 EDD8 979B Skype: misch42

1 0

FreeRADIUS 2 not listening on right port
by Casartello, Thomas 18 Jun '08

18 Jun '08

I just upgraded by FreeRADIUS server from the version 1 to version 2 family. I have the listen {} statements configured as follows: radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 1812 } listen { type = "acct" ipaddr = * port = 1813 } main { snmp = no smux_password = "" snmp_write_access = no } Listening on authentication address * port 41045 Listening on accounting address * port 54893 Listening on proxy address * port 38374 Ready to process requests. However as you can see if always listens on random ports. What am I doing wrong? I am using version 2.0.2 which was distributed with Fedora 9. Thomas E. Casartello, Jr. Infrastructure Technician Linux Specialist Department of Information Technology Westfield State College Wilson 105-A (413) 572-8245 E-Mail: tcasartello(a)wsc.ma.edu Red Hat Certified Technician (RHCT)

10 41

MacOSX Leopard authentication with Freeradius
by Jelle Langbroek 18 Jun '08

18 Jun '08

Hi, I'm using freeRadius 2.0.3 on my WLAN. I have WindowsXP, WindowsVista and Apple (OSX) clients. Windows clients authenticate well with freeRadius but I have problems with OSX Leopard. I can't figure out where the problem originates from. I'm using MySQL, Cleartext-Passwords, PEAP auth, WPA-Enterprise, AES. The error that pops up while authenticating OSX is the following (see below for extended logs): Tue Jun 17 20:02:53 2008 : Error: TLS Alert read:warning:close notify Tue Jun 17 20:02:53 2008 : Auth: Login incorrect: [userX] (from client NAS1-WiFi port 8 cli 001c34c14d76) Does anybody have experience with OSX clients and freeRadius? Does anybody have a radiusd and eap configuration file which is known to work with OSX Leopard and could you post it to me? Ofcourse I realise that the problem could be with the AP (WAP54G) or the clients itself. I've done many hours of testing/reading though but can't figure out what's causing it. Ok, thanks for all your help! gr, Jelle Logs of "radiusd -X": -> As you can see I use a littlebit of a hacked version of the SQL implementation to use another MySQL table (integration with Lan Management System), but that shouldn't matter. As I said, other clients authenticate without problems. User-Name = "userX" NAS-IP-Address = 172.16.27.18 Called-Station-Id = "001a70abad32" Calling-Station-Id = "001b63c13f76" NAS-Identifier = "001a70abad32" NAS-Port = 8 Framed-MTU = 1400 State = 0xeb256c65e8d575619976542f479f49d4 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x02f0002f1980000000251503010020c5ac7365546396895a7fb74e2ab11d3ec7a8f2de0a7c761fda82cbd9f1a99de2 Message-Authenticator = 0x2f90d0e5a8325a3bf379f1243dda8195 +- entering group authorize ++[preprocess] returns ok expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/172.16.27.18/auth-detail-20080617 rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/172.16.27.18/auth-detail-20080617 expand: %t -> Tue Jun 17 20:17:07 2008 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "userX", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 240 length 47 rlm_eap: Continuing tunnel setup. ++[eap] returns ok expand: %{User-Name} -> userX rlm_sql (sql): sql_set_user escaped user --> 'userX' rlm_sql (sql): Reserving sql socket id: 0 expand: SELECT ownerid as id, username, 'Cleartext-Password' as attribute, passwd as value, ':=' as op FROM nodes WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT ownerid as id, username, 'Cleartext-Password' as attribute, passwd as value, ':=' as op FROM nodes WHERE username = 'userX' ORDER BY id rlm_sql (sql): User found in radcheck table expand: SELECT ownerid as id, username, 'Cleartext-Password' as attribute, passwd as value, ':=' as op FROM nodes WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT ownerid as id, username, 'Cleartext-Password' as attribute, passwd as value, ':=' as op FROM nodes WHERE username = 'userX' ORDER BY id expand: SELECT 'dynamic' as groupname FROM customers WHERE name = '%{SQL-User-Name}' ORDER BY id -> SELECT 'dynamic' as groupname FROM customers WHERE name = 'userX' ORDER BY id rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS TLS Length 37 rlm_eap_tls: Length Included eaptls_verify returned 11 eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], warning close_notify TLS Alert read:warning:close notify SSL Connection Established rlm_eap_tls: Application Data rlm_eap_peap: Tunneled data is invalid. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select ++[eap] returns invalid auth: Failed to validate the user. Login incorrect: [userX/<via Auth-Type = EAP>] (from client NAS1-WiFi port 8 cli 001b63c13f76) Delaying reject of request 9 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 9 EAP-Message = 0x04f00004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 4.9 seconds. Cleaning up request 9 ID 0 with timestamp +33

3 2

high performance FR installation and unfinished requests
by Michael Schwartzkopff 18 Jun '08

18 Jun '08

Hi, we have a FR server (version 1.1.7) on a Redhat machine. We use it for dumping accouting requests into a database. We have about 200 requests per second in average. Once in a while (1 per minute) we see a error in the log file: Discarding duplicate request from client ... due to unfinished request .... Does the FR server drop accouting requests? How can we monitor how any requests the RADIUS server gets? Is this anything to worry? Thanks for any help. -- Dr. Michael Schwartzkopff MultiNET Services GmbH Addresse: Bretonischer Ring 7; 85630 Grasbrunn; Germany Tel: +49 - 89 - 45 69 11 0 Fax: +49 - 89 - 45 69 11 21 mob: +49 - 174 - 343 28 75 mail: misch(a)multinet.de web: www.multinet.de Sitz der Gesellschaft: 85630 Grasbrunn Registergericht: Amtsgericht München HRB 114375 Geschäftsführer: Günter Jurgeneit, Hubert Martens --- PGP Fingerprint: F919 3919 FF12 ED5A 2801 DEA6 AA77 57A4 EDD8 979B Skype: misch42

4 8

accouting log twice
by Mathieu Lemaitre 18 Jun '08

18 Jun '08

Hello, We use freeradius for our clients. Clients have a username with a realm, like user@domain. Proxy radius and radius server are on the same machine, and my proxy.conf looks like this: realm domain { type = radius authhost = localhost:1812 accthost = localhost:1813 secret = secret } Users can log in, but accounting seems to have problems: on accounting start: Wed Jun 18 11:43:30 2008 : Info: rlm_radutmp: Login entry for NAS nas port 167 duplicate on accounting stop: Wed Jun 18 11:42:05 2008 : Error: rlm_radutmp: Logout for NAS nas port 20, but no Login record Accounting is logged in a mysql database, but appears twice: once with the realm (user@domain), and once without (user). What can I do for proxied requests not to be logged ? Pre-proxy logs seems to be disabled in the radiusd.conf: # detail pre_proxy_log { # detailfile = ${radacctdir}/%{Client-IP-Address}/pre-proxy-detail-%Y%m%d # # This MUST be 0600, otherwise anyone can read # the users passwords! # detailperm = 0600 # } Could a use attr_rewrite in this case, with something like this : attr_rewrite sanecallerid { attribute = UserName # may be "packet", "reply", "proxy", "proxy_reply" or "config" searchin = packet searchfor = "domain" replacewith = "" ignore_case = no new_attribute = no max_matches = 10 ## If set to yes then the replace string will be appended to the original string append = no } Thanks for tour answers, Mathieu

2 1

cvs version and dhcp
by Evgeniy Kozhuhovskiy 18 Jun '08

18 Jun '08

I've just upgraded to cvs version, dhcp seems to be broken (?) Failed reading DHCP socket: Invalid argumentWed Jun 18 11:03:35 2008 : Error: Wed Jun 18 11:03:35 2008 : Debug: Ready to process requests. Failed reading DHCP socket: Invalid argumentWed Jun 18 11:03:35 2008 : Error: Wed Jun 18 11:03:35 2008 : Debug: Ready to process requests. dhcp-site differs from example only with changed interface names and mac2ip uncommented. -- With best regards, Evgeniy Kozhuhovskiy, Leader of Services team, Minsk State Phony Network, RUE Beltelecom.

2 2

matching on IP Address
by King, Adam 18 Jun '08

18 Jun '08

Hi, I am running this query: if ("%{sql: SELECT COUNT(nas_ip) FROM `nas_ip` WHERE nas_ip='127.0.0.1'}">0){ redundant { sql1 sql2 } } But the if ("%{sql: SELECT COUNT(nas_ip) FROM `nas_ip` WHERE nas_ip='127.0.0.1'}">0) section always returns false even though the database has the 'nas_ip' table containing 127.0.0.1 as the data Any ideas? Thanks Adam King Network Engineer adam.king(a)intechnology.com InTechnology plc Support 0845 120 7070 Telephone 01423 850000 Facsimile 01423 858866 www.intechnology.com * Harrogate, Reading, London * 200 people, ?50m p.a. turnover * Over 500 corporate clients * Specialist Business Solutions & Services Provider This is an email from InTechnology plc, Central House, Beckwith Knowle, Harrogate, UK, HG3 1UG. Registered in England 3916586. The contents of this message may be privileged and confidential. If you have received this message in error, you may not use, disclose, copy or distribute its content in anyway. Please notify the sender immediately. All messages are scanned for all viruses.

2 9

Problem in connecting to switch on telnet
by Guk Viktor 18 Jun '08

18 Jun '08

By thanks for help, I was dismantled. But another problem arose. Radius answers: modcall: entering group authenticate for request 0 HASH: user admin found in hashtable bucket 45083 modcall[authenticate]: module "unix" returns ok for request 0 modcall: leaving group authenticate (returns ok) for request 0 Login OK: [admin/admin] (from client 10.0.1.2 port 117616641 cli 0000-0000-0000) Sending Access-Accept of id 19 to 10.0.1.2 port 5007 3Com-User-Access-Level = Administrator Finished request 0 But I cannot be connected on telnet. Now switch(3com 5500-EI) answers that incorrect password: Username:admin Password: % Login failed! > Prompt, what to make in that case. In the file /etc/passwd there is > >this line of " admin:x:500:500::/home/admin:/bin/bash ". How it > >is necessary to assign password? > > > > > >Message: 4 > >Date: Tue, 17 Jun 2008 09:33:31 +0100 > >From: "Ivan Kalik" <tnt(a)kalik.net> > >Subject: Re: Problem in connecting to switch on telnet > >To: "FreeRadius users mailing list" > > <freeradius-users(a)lists.freeradius.org> > >Message-ID: <JBqwPney.1213691611.8437380.tnt(a)kalik.co.yu> > >Content-Type: text/plain; charset=ISO-8859-2 > > > >You have deleted the part of the debug which tells how is Auth-Type set. > >Post the whole thing. BTW, now you do have admin account in /etc/passwd > >but the password is wrong. It's still not using password from the users > >file. > > > >Ivan Kalik > >Kalik Informatika ISP > > > > > >Dana 17/6/2008, "Guk Viktor" <v.guk(a)zaz.zp.ua> pi?e: > > > > > > > > It tried without Auth-Type = System, also tried Auth-Type = Local. > > > >Processing the authenticate section of radius.conf > >modcall: entering group authenticate for request 0 > >rlm_unix: [admin]: invalid password > >modcall[authenticate]: module "unix" returns reject for request 0 > >modcall: leaving group authenticate (returns reject) for request 0 > >auth: Failed to validate the user. > >Login incorrect: [admin/admin] (from client 10.0.1.2 port 117612545 cli > >0000-0000-0000) > > > > > > Message: 4 Date: Fri, 13 Jun 2008 15:38:57 +0100 From: "Ivan Kalik" > ><tnt(a)kalik.net> Subject: Re: Problem in connecting to switch on telnet > >To: "FreeRadius users mailing list" > ><freeradius-users(a)lists.freeradius.org> Message-ID: > ><wbdeeigX.1213367937.5098900.tnt(a)kalik.co.yu> Content-Type: > >text/plain; charset=ISO-8859-2 You are setting up the wrong > >authentication type. Remove Auth-Type =System from user configuration. > >1.1.3 is old. I am not sure do you need to set Auth-Type there. If it > >doesn't work without it set Auth-Type = Local. Ivan Kalik Kalik > >Informatika ISP Dana 13/6/2008, "Guk Viktor" <v.guk(a)zaz.zp.ua> pi?e: > > > > > > > > > > > > > > > > > >Hello, > > > >I have freeradius-1.1.3 and 3com switch 5500-EI. On the > >switch is disposed the access of users into the network through > >freeradius. Arose problem in > >connecting to switch on telnet. In the log freeradius it is indicated > >that the incorrect password (however password I introduce correctly). > > > >rad_recv: Access-Request packet from host 10.0.1.2:5007, id=1, > >length=203 > >??????? User-Name = "admin" > >??????? User-Password = "admin" > >??????? NAS-IP-Address = 10.0.1.2 > >??????? NAS-Identifier = "001ac1d4ee42" > >??????? NAS-Port = 117612545 > >??????? NAS-Port-Id = "unit=7;subslot=0;port=42;vlanid=1" > >??????? NAS-Port-Type = Ethernet > >??????? Service-Type = Login-User > >??????? Login-IP-Host = 10.0.1.2 > >??????? Calling-Station-Id = "0000-0000-0000" > >??????? Framed-IP-Address = 10.0.1.100 > >??????? Vendor-25506-Attr-26 = 0x00000003 > >??????? Vendor-25506-Attr-255 = 0x353530302d4549 > >??????? Vendor-25506-Attr-60 = > >0x31302e302e312e3130302030303a30303a30303a30303a30303a3030 > >??????? Vendor-25506-Attr-59 = 0x38e68c68 > >? Processing the authorize section of radiusd.conf > >modcall: entering group authorize for request 0 > >? modcall[authorize]: module "mschap" returns noop for request 0 > >??? rlm_realm: No '\' in User-Name = "admin", looking up realm NULL > >??? rlm_realm: No such realm "NULL" > >? modcall[authorize]: module "ntdomain" returns noop for request 0 > >? rlm_eap: No EAP-Message, not doing EAP > >? modcall[authorize]: module "eap" returns noop for request 0 > >??? users: Matched entry DEFAULT at line 152 > >??? users: Matched entry admin at line 216 > >? modcall[authorize]: module "files" returns ok for request 0 > >modcall: leaving group authorize (returns ok) for request 0 > >? rad_check_password:? Found Auth-Type System > >auth: type "System" > >? Processing the authenticate section of > >radiusd.conf > >modcall: entering group authenticate for request 0 > >? modcall[authenticate]: module "unix" returns notfound for request 0 > >modcall: leaving group authenticate (returns notfound) for request 0 > >auth: Failed to validate the user. > >Login incorrect: [admin/admin] (from > >client 10.0.1.2 port 117612545 cli 0000-0000-0000) > >Delaying request 0 for 1 seconds > >Finished request 0 > > > >Users: > >admin?? Auth-Type = System, User-Password == "admin" > >??? ?? 3Com-User-Access-Level = Administrator > > > >eap.conf: > >eap{ > >??? default_eap_type = peap > >??? timer_expire = 60 > >??? ignore_unknown_eap_type = no > >??? cisco_accounting_username_bug = no > >??? > >??? md5{ > >??? ?? } > > > >??? leap{ > >??? ?? } > > > >??? gtc{ > >??? ?? auth_type = PAP > >??? ?? } > > > >??? peap{ > >??? ?? default_eap_type = mschapv2 > >??? ?? use_tunneled_reply = yes > >??? ?? } > > > >??? mschapv2{ > >??? ?? } > >??? } > > > >It can possibly use a local authorization to switch on telnet, > >without freeradius. > > > >Viktor Guk

2 1

compile error on suse 10.3
by Norbert Wegener 18 Jun '08

18 Jun '08

Building an rpm from the current cvs on suse 10.3 fails with: Checking for unpackaged file(s): /usr/lib/rpm/check-files /var/tmp/freeradius-server-2.0.5-build error: Installed (but unpackaged) file(s) found: /etc/raddb/sql/oracle/msqlippool.txt RPM build errors: Installed (but unpackaged) file(s) found: /etc/raddb/sql/oracle/msqlippool.txt Norbert Wegener

2 1

Dear freeradius-users@list.xs4all.nl Savings ...3 Days Only
by Maura Richey 18 Jun '08

18 Jun '08

1 0