- Freeradius-Users - lists.freeradius.org

assert failed event.c and perl performance
by Julien Leloup 18 Apr '08

18 Apr '08

Hi, I'm running FreeRadius 2.0.3 under FreeBSD 6.3, in a proxy configuration. This server is using rlm_perl in a post-proxy phase to realize some operations on Access-Accept attributes, with the use of a MySQL database. The same configuration, in FreeRadius 2.0.1 worked fine, but when I recompiled Perl 5.8.8 with IThreads support, I also upgraded FreeRadius in 2.0.3 and now I'm going through an error, only when the home server is not alive, or not responding : Rejecting request 0 due to lack of any response from home server x.x.x.x port 1645 There was no response configured: rejecting request 0 Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> xxxxx attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 215 to x.x.x.x port 49727 Finished request 0. ASSERT FAILED event.c[956]: request->next_callback != NULL Abort This error is happening even if I use a non-IThread Perl, or if I remove the use of rlm_perl in post-proxy, so I'm pretty sure it's not related to the use of the thread configuration of Perl. Does anyone having the same problem ? I haven't found a trace of this kind of bug between 2.0.1 and 2.0.3 versions of FreeRadius, only a discussion on this mailing list from september 2007. Subsidiary question : I'm not a perl, or freeradius performance expert, so I'm not sure if it's necessary to use a thread configuration of Perl to handle something like 40.000 proxied requests (in a "Armageddon" scenario), with a decent server. What do you think about it ? Best regards, Julien Leloup Axione 130/132 Boulevard Camélinat 92240 MALAKOFF FRANCE

2 2

Dan Schaffer is out of the office.
by Dan Schaffer 18 Apr '08

18 Apr '08

I will be out of the office starting 04/17/2008 and will not return until 04/21/2008. Thank you and have a nice day, Dan

1 0

rlm_exec question
by T Kid82 18 Apr '08

18 Apr '08

Hi everyone, I am trying to accomplish a very simple task using RADIUS as an authentication proxy. All I need it to do is use the username/password combo sent in, run a perl script to validate those credentials and return a pass or fail. I have my perl script setup to return all the right codes as the radiusd.conf specifies. ( < 0 : fail, 0 : ok , etc...) I have added the following changes to the radiusd.conf file, everything else is as it is out of the box. authorize { preprocess exec } authenticate { Auth-Type Exec { exec } } In the modules section I added my program name / perl script (the location is just a temp thing to get this going): exec { program = "/usr/bin/authenticate.pl" wait = yes input_pairs = request output_pairs = reply } When i run radtest, this is what I see in the logs User-Name = "tkid" User-Password = "hlsearch" NAS-IP-Address = 127.0.0.1 NAS-Port = 1645 +- entering group authorize ++[preprocess] returns ok Exec-Program output: Error: Password check passed Exec-Program: returned: 0 ++[exec] returns ok auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [tkid/hlsearch] (from client localhost port 1645) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> tkid attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 149 with timestamp +10 Ready to process requests. In essence, all I want is authentication and not authorization. How do I accomplish that here? Thanks for your help in advance. Thanks, -- Tauseef

4 7

clients can't authenticate in FR 2.0.3
by Gustavo Chavelas 18 Apr '08

18 Apr '08

Hi again. Please Help me. I'm very desperate. I want to put a freeradius 2.0.3 why i need to connect a Windows XP, Vista and CE. But when I to configure the freeradius-1.1.3-1.2.el5 (rpm) it works fine. My windows XP and CE clients connect without problems, but I need urgently to connect a Windows Vista clients too. Please HELP ME. Alan Dekok, do you have any suggest? Or do you know any HOW TO based over FR 2.0.3?

2 1

Possible to limit user access to different types of authentication?
by Ryan 18 Apr '08

18 Apr '08

Hi All, I'm currently using 2.0.3 with authentication via LDAP. Currently I have situation whereby there is a requirement to explore on limiting access to the various types of authentication available. Is it possible to configure to do so? That is some users can authenticate using just PAP and some other users can connect using EAP-PEAP? Thanks/Regards, Ryan

2 2

Re: newbie on radiustesting, Buxey and Hood
by Si St 18 Apr '08

18 Apr '08

By the way: What would be the difference having the proposal of Andrew Hood performed: find /etc/raddb/ -type d -exec chmod ug+x {} \; compared to the proposal of Alan Buxey: chmod -R ugo+x /etc/raddb/certs I am not so familiar with the /-type d/ part of the find command Would the result be the same? .................................................. > ----- Original Message ----- > From: "Andrew Hood" <freeradius(a)andyhood.net> > To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> > Subject: Re: newbie on radiustesting > Date: Thu, 17 Apr 2008 13:34:08 +1000 > > > Si St wrote: > > > linux:/etc/raddb/certs # l > > insgesamt 53 > > drw-r----- 3 root radiusd 472 2008-03-31 22:53 ./ > > drwxr-xr-x 5 root root 728 2008-04-16 20:40 ../ > > -rw-r----- 1 root radiusd 721 2005-09-13 04:15 cert-clt.der > > -rw-r----- 1 root radiusd 1741 2005-09-13 04:15 cert-clt.p12 > > -rw-r----- 1 root radiusd 2452 2005-09-13 04:15 cert-clt.pem > > -rw-r----- 1 root radiusd 717 2005-09-13 04:15 cert-srv.der > > -rw-r----- 1 root radiusd 1733 2005-09-13 04:15 cert-srv.p12 > > -rw-r----- 1 root radiusd 2439 2005-09-13 04:15 cert-srv.pem > > drw-r----- 2 root radiusd 200 2008-03-31 22:53 demoCA/ > > -rw-r----- 1 root radiusd 0 2005-09-13 04:15 dh > > -rw-r----- 1 root radiusd 2913 2005-09-13 04:15 newcert.pem > > -rw-r----- 1 root radiusd 1753 2005-09-13 04:15 newreq.pem > > -rw-r----- 1 root radiusd 1024 2005-09-13 04:15 random > > -rw-r----- 1 root radiusd 431 2005-09-13 04:15 README > > -rw-r----- 1 root radiusd 954 2005-09-13 04:15 root.der > > -rw-r----- 1 root radiusd 1973 2005-09-13 04:15 root.p12 > > -rw-r----- 1 root radiusd 2764 2005-09-13 04:15 root.pem > > > > linux:/etc/raddb/certs/demoCA # l > > insgesamt 21 > > drw-r----- 2 root radiusd 200 2008-03-31 22:53 ./ > > drw-r----- 3 root radiusd 472 2008-03-31 22:53 ../ > > -rw-r----- 1 root radiusd 1346 2005-09-13 04:15 cacert.pem > > -rw-r----- 1 root radiusd 276 2005-09-13 04:15 index.txt > > -rw-r----- 1 root radiusd 140 2005-09-13 04:15 index.txt.old > > -rw-r----- 1 root radiusd 3 2005-09-13 04:15 serial > > -rw-r----- 1 root radiusd 3 2005-09-13 04:15 serial.old > > Bad directory perms? > > umask 022 > find /etc/raddb/ -type d -exec chmod ug+x {} \; > > -- > REALITY.SYS not found: Universe halted. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > -- _______________________________________________ Surf the Web in a faster, safer and easier way: Download Opera 9 at http://www.opera.com Powered by Outblaze

3 2

Re: newbie on radiustesting ! Now, Buxey!
by Si St 17 Apr '08

17 Apr '08

> ----- Original Message ----- > From: A.L.M.Buxey(a)lboro.ac.uk > To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> > Subject: Re: newbie on radiustesting ! > Date: Thu, 17 Apr 2008 14:21:44 +0100 > > > Hi, > > > > By the way does this excerpt from the top page of radiusd.conf > > tell > anything about the problem? > > you are not getting undefined symbols...your uid and gid arent above > 6000 etc etc so none of it applies > > > While changing the eap.conf by accident the group was changed to > > root instead staying on group radiusd.( I changed betw 2 files: > > the orig eap.conf and changed eap.conf) > > So after doing chgrp radiusd eap.conf now the error message has > > changed to this: > > eap.conf isnt an issue - the issue is with being able to read > /etc/raddb/certs/demoCA/cacert.pem > > chmod -R ugo+x //etc/raddb/certs > > ? > > alan > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ............................................................ Now we are getting somewhere: linux:/etc/raddb # chmod -R ugo+x /etc/raddb/certs linux:/etc/raddb # l certs/ insgesamt 53 drwxr-x--x 3 root radiusd 472 2008-03-31 22:53 ./ drwxr-xr-x 5 root root 728 2008-04-17 13:09 ../ -rwxr-x--x 1 root radiusd 721 2005-09-13 04:15 cert-clt.der* -rwxr-x--x 1 root radiusd 1741 2005-09-13 04:15 cert-clt.p12* -rwxr-x--x 1 root radiusd 2452 2005-09-13 04:15 cert-clt.pem* -rwxr-x--x 1 root radiusd 717 2005-09-13 04:15 cert-srv.der* -rwxr-x--x 1 root radiusd 1733 2005-09-13 04:15 cert-srv.p12* -rwxr-x--x 1 root radiusd 2439 2005-09-13 04:15 cert-srv.pem* drwxr-x--x 2 root radiusd 200 2008-03-31 22:53 demoCA/ -rwxr-x--x 1 root radiusd 0 2005-09-13 04:15 dh* -rwxr-x--x 1 root radiusd 2913 2005-09-13 04:15 newcert.pem* -rwxr-x--x 1 root radiusd 1753 2005-09-13 04:15 newreq.pem* -rwxr-x--x 1 root radiusd 1024 2005-09-13 04:15 random* -rwxr-x--x 1 root radiusd 431 2005-09-13 04:15 README* -rwxr-x--x 1 root radiusd 954 2005-09-13 04:15 root.der* -rwxr-x--x 1 root radiusd 1973 2005-09-13 04:15 root.p12* -rwxr-x--x 1 root radiusd 2764 2005-09-13 04:15 root.pem* linux:/etc/raddb # radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = yes tls: check_cert_cn = "%{User-Name}" rlm_eap: Loaded and initialized type tls mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. What do you think about this? You must have done something right! What do you recommend to proceed with when this seem to be all right? -- _______________________________________________ Surf the Web in a faster, safer and easier way: Download Opera 9 at http://www.opera.com Powered by Outblaze

2 1

Re: newbie on radiustesting, Buxey and Hood; Nº 2
by Si St 17 Apr '08

17 Apr '08

Probably getting tired of me, but I have tried out output with the different permissions by Hood and Buxey: Changing first certs and demoCA to 640 along with files thereof to 640 as originally, then: linux:/etc/raddb # find /etc/raddb/ -type d -exec chmod ug+x {} \; linux:/etc/raddb # radiusd -X > WOOD.log Then repeating the 640 things..., then: linux:/etc/raddb # chmod -R ugo+x /etc/raddb/certs linux:/etc/raddb # radiusd -X > BUXEY.log linux:/etc/raddb # cksum WOOD.log BUXEY.log 3877618374 5222 WOOD.log 3877618374 5222 BUXEY.log Does this mean that the permission settings by Hood only changing the ./certs and the ./demoCA directories from 640 (drwr-----) to 750 (drwxr-x--) suffices? In Hoods instance the files themselves remained 640. Remember the directories were originally 640 (quote from earlier message): > linux:/etc/raddb/certs # l > insgesamt 53 > drw-r----- 3 root radiusd 472 2008-03-31 22:53 ./ ..................................... > ----- Original Message ----- > From: "Si St" <sigbj-st(a)operamail.com> > To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> > Subject: Re: newbie on radiustesting, Buxey and Hood > Date: Thu, 17 Apr 2008 17:29:36 +0100 > > > By the way: > What would be the difference having the proposal of Andrew Hood performed: > > find /etc/raddb/ -type d -exec chmod ug+x {} \; > > compared to the proposal of Alan Buxey: > > chmod -R ugo+x /etc/raddb/certs > > I am not so familiar with the /-type d/ part of the find command > Would the result be the same? > > > .................................................. > > ----- Original Message ----- > > From: "Andrew Hood" <freeradius(a)andyhood.net> > > To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> > > Subject: Re: newbie on radiustesting > > Date: Thu, 17 Apr 2008 13:34:08 +1000 > > > > > > Si St wrote: > > > > > linux:/etc/raddb/certs # l > > > insgesamt 53 > > > drw-r----- 3 root radiusd 472 2008-03-31 22:53 ./ > > > drwxr-xr-x 5 root root 728 2008-04-16 20:40 ../ > > > -rw-r----- 1 root radiusd 721 2005-09-13 04:15 cert-clt.der > > > -rw-r----- 1 root radiusd 1741 2005-09-13 04:15 cert-clt.p12 > > > -rw-r----- 1 root radiusd 2452 2005-09-13 04:15 cert-clt.pem > > > -rw-r----- 1 root radiusd 717 2005-09-13 04:15 cert-srv.der > > > -rw-r----- 1 root radiusd 1733 2005-09-13 04:15 cert-srv.p12 > > > -rw-r----- 1 root radiusd 2439 2005-09-13 04:15 cert-srv.pem > > > drw-r----- 2 root radiusd 200 2008-03-31 22:53 demoCA/ > > > -rw-r----- 1 root radiusd 0 2005-09-13 04:15 dh > > > -rw-r----- 1 root radiusd 2913 2005-09-13 04:15 newcert.pem > > > -rw-r----- 1 root radiusd 1753 2005-09-13 04:15 newreq.pem > > > -rw-r----- 1 root radiusd 1024 2005-09-13 04:15 random > > > -rw-r----- 1 root radiusd 431 2005-09-13 04:15 README > > > -rw-r----- 1 root radiusd 954 2005-09-13 04:15 root.der > > > -rw-r----- 1 root radiusd 1973 2005-09-13 04:15 root.p12 > > > -rw-r----- 1 root radiusd 2764 2005-09-13 04:15 root.pem > > > > > > linux:/etc/raddb/certs/demoCA # l > > > insgesamt 21 > > > drw-r----- 2 root radiusd 200 2008-03-31 22:53 ./ > > > drw-r----- 3 root radiusd 472 2008-03-31 22:53 ../ > > > -rw-r----- 1 root radiusd 1346 2005-09-13 04:15 cacert.pem > > > -rw-r----- 1 root radiusd 276 2005-09-13 04:15 index.txt > > > -rw-r----- 1 root radiusd 140 2005-09-13 04:15 index.txt.old > > > -rw-r----- 1 root radiusd 3 2005-09-13 04:15 serial > > > -rw-r----- 1 root radiusd 3 2005-09-13 04:15 serial.old > > > > Bad directory perms? > > > > umask 022 > > find /etc/raddb/ -type d -exec chmod ug+x {} \; > > > > -- > > REALITY.SYS not found: Universe halted. > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > > > -- > _______________________________________________ > Surf the Web in a faster, safer and easier way: > Download Opera 9 at http://www.opera.com > > Powered by Outblaze > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > -- _______________________________________________ Surf the Web in a faster, safer and easier way: Download Opera 9 at http://www.opera.com Powered by Outblaze

1 0

rlm_sql - Different table for User authentication
by rsg 17 Apr '08

17 Apr '08

Hi, I need to use a different auth table for Username/Password check. Here are the modifications I made into config. #raddb/sql.conf : authcheck_table = "authcheck" : . #raddb/sql/mysql/dialup.conf : . ## +++++++++ Here i retain the order of return data but omit some Attributes (2. Attr Name and 4.Attr Operation as described in Authorization Queries) +++++ authorize_check_query = "SELECT id, userid, passwd \ FROM ${authcheck_table} \ WHERE userid = '%{SQL-User-Name}' \ ORDER BY id" ## +++++++++++++I DID NOT TOUCH THE REPLY QUERY ++++++++++++++++++++++++++++++++++++++ authorize_reply_query = "SELECT id, username, attribute, value, op \ FROM ${authreply_table} \ WHERE username = '%{SQL-User-Name}' \ ORDER BY id" : . When I tried to authenticate a user I get a segmentation fault as follows; ------ rlm_sql (sql): sql_set_user escaped user --> 'test' rlm_sql (sql): Reserving sql socket id: 2 expand: SELECT id, userid , password FROM authcheck WHERE userid = '%{SQL-User-Name}' ORDER BY id -> SELECT id, userid, password FROM authcheck WHERE login = 'test' ORDER BY id Segmentation fault ------ Are there any particular parameters/settings that i've missed here? Thanks for the suggestions. rg

4 4

rlm_ldap Auth-Type
by Christian Goebel 17 Apr '08

17 Apr '08

Hi, I have configured a FR 2.0.3 with eap-ttls with an authorize section in the inner-tunnel with the a ldap redundant-load-balance. In the ldap section the set_auth_type = yes is set but it only works if I put: update control { Auth-Type := LDAP } after the ldap in the inner-tunnel config, otherwise I will get an error: ------------- rlm_ldap: user ****** authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap1] returns ok ++- redundant-load-balance group redundant-load-balance returns ok ++[expiration] returns noop ++[logintime] returns noop WARNING: You set Proxy-To-Realm = LOCAL, but it is a LOCAL realm! Cancelling invalid proxy request. auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: ------------- Is this behaviour correct? Is that not the job of the rlm_ldap to set the Auth-Type if the set_auth_type is set? Or did I do this completely wrong? Thx, Christian -- Christian Goebel _______________________________________________ Centre de Technologie de l'Education 29 avenue John F. Kennedy L-1855 Luxembourg-Kirchberg tél.: +352 247-85975 fax: +352 333797 _______________________________________________

2 1