- Freeradius-Users - lists.freeradius.org

Re: Problem with proxy-radius function
by Ivan Popov 11 Apr '08

11 Apr '08

Hello Debug is difficult because of Segmentation Fault. I will try to rebuild radius (in the night) with last patch , that you already provide. Is It something wrong whth my configuration? I decide to disable all nonused modules. Maybe I disable something major? root@aaa# radiusd -X FreeRADIUS Version 2.0.4, for host i686-pc-linux-gnu, built on Apr 7 2008 at 10:36:05 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including configuration file /etc/raddb/sql.conf including configuration file /etc/raddb/sql/postgresql/dialup.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 8192 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes security { max_attributes = 200 reject_delay = 1 status_server = no } } client MAIN_NAS { ipaddr = 192.168.101.1 netmask = 32 require_message_authenticator = no secret = "key" shortname = "nas1" nastype = "other" } client jds { ipaddr = 192.168.0.1 require_message_authenticator = no secret = "superkey" shortname = "jds" nastype = "other" } client jds2 { ipaddr = 192.168.0.2 require_message_authenticator = no secret = "superkey" shortname = "jds2" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server jds1 { ipaddr = 192.168.0.1 port = 1646 type = "acct" secret = "superkey" response_window = 30 max_outstanding = 65536 zombie_period = 40 status_check = "request" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 300 status_check_timeout = 4 } home_server jds2 { ipaddr = 192.168.0.2 port = 1646 type = "acct" secret = "superkey" response_window = 30 max_outstanding = 65536 zombie_period = 40 status_check = "request" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 300 status_check_timeout = 4 } home_server_pool jds { type = fail-over home_server = jds1 home_server = jds2 } realm domain.com { acct_pool = jds nostrip } radiusd: #### Instantiating modules #### instantiate { } radiusd: #### Loading Virtual Servers #### server { modules { Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "Calling-Station-Id, Acct-Session-Id, 3GPP2-Correlation-Id" } Module: Linked to module rlm_sql Module: Instantiating sql sql { driver = "rlm_sql_postgresql" server = "localhost" port = "" login = "rad" password = "......" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 48 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id,nasname,shortname,type,secret FROM nas" authorize_check_query = "" authorize_reply_query = "" authorize_group_check_query = "" authorize_group_reply_query = "" accounting_onoff_query = "" accounting_update_query = "" accounting_update_query_alt = "" accounting_start_query = "INSERT into radacct (AcctSessionId, AcctUniqueId, CallingStationId, AcctStartTime, AcctStopTime, superkeyActiveTime, AcctInputOctets, AcctOutputOctets, FramedIPAddress, UserName, ReleaseIndicator, superkeyBadPPPFrameCount, superkeyCorrelationId, AcctSessionTime, NASIPAddress) values('%{Acct-Session-Id}', '%{Acct- Unique-Session-Id}', '%{Calling-Station-Id}', '%S', NULL,'0', '0', '0', '%{Framed-IP-Address}', trim('%{SQL-User-Name}'), '0', '0', '%{3GPP2-Correlation-Id}', '0', '%{NAS-IP- Address}')" accounting_start_query_alt = "" accounting_stop_query = "UPDATE radacct SET AcctStopTime = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', OutputPacket = '% {Acct-Output-Packets}', InputPacket = '%{Acct-Input-Packets}', AcctOutputOctets = '%{Acct-Output-Octets}', ReleaseIndicator = '%{Acct-Terminate-Cause}', superkeyBadPPPFrameCount = '%{3GPP2-Bad-PPP-Frame-Count}', superkeyCorrelationId = '%{3GPP2-Correlation-Id}', superkeyActiveTime = '%{3GPP2-Active-Time}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" accounting_stop_query_alt = "" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "" postauth_query = "" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_postgresql (module rlm_sql_postgresql) loaded and linked rlm_sql (sql): Attempting to connect to radacc@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #0 rlm_sql (sql): Connected new DB handle, #0 ......... rlm_sql (sql): starting 47 rlm_sql (sql): Attempting to connect rlm_sql_postgresql #47 rlm_sql (sql): Connected new DB handle, #47 Module: Checking pre-proxy {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating pre_proxy_log detail pre_proxy_log { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/pre-proxy-detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Checking post-proxy {...} for more modules to load Module: Instantiating post_proxy_log detail post_proxy_log { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/post-proxy-detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } } } radiusd: #### Opening IP addresses and Ports #### listen { type = "acct" ipaddr = * port = 0 } Listening on accounting address * port 1813 Listening on proxy address * port 1222 Ready to process requests. Acct-Status-Type = Start User-Name = "test1(a)domain.com" Calling-Station-Id = "77734565" Framed-IP-Address = 192.168.50.19 NAS-IP-Address = X.X.X.X Event-Timestamp = "Apr 10 2008 17:08:14 EEST" Acct-Session-Id = "0000000\000" NAS-Port-Type = Virtual NAS-Port = 1813 Acct-Delay-Time = 0 Service-Type = Framed-User Acct-Authentic = RADIUS 3GPP2-ESN = "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" 3GPP2-Attr-116 = 0x0000000000000000000000000000 3GPP2-Correlation-Id = "09446618" 3GPP2-Service-Reference-Id = 0x00000000 3GPP2-Home-Agent-IP-Address = 0.0.0.0 3GPP2-BSID = "2A2100021102" 3GPP2-User-Id = 0 3GPP2-Forward-FCH-Mux-Option = 0 3GPP2-Reverse-FCH-Mux-Option = 0 3GPP2-Service-Option = 59 3GPP2-Forward-Traffic-Type = 0 3GPP2-Reverse-Traffic-Type = 0 3GPP2-FCH-Frame-Size = 0 3GPP2-Forward-FCH-RC = 0 3GPP2-Reverse-FCH-RC = 0 3GPP2-IP-Technology = 1 3GPP2-Compulsory-Tunnel-Indicator = 0 3GPP2-DCCH-Frame-Size = 0 3GPP2-Attr-78 = 0x00000000 3GPP2-Forward-PDCH-RC = 0 3GPP2-Forward-DCCH-Mux-Option = 0 3GPP2-Reverse-DCCH-Mux-Option = 0 3GPP2-Forward-DCCH-RC = 0 3GPP2-Reverse-DHHC-RC = 0 3GPP2-Attr-114 = 0x00000000 3GPP2-IP-QoS = 10 3GPP2-Airlink-Priority = 0 +- entering group preacct rlm_realm: Looking up realm "domain.com" for User-Name = "test1(a)domain.com" rlm_realm: Found realm "domain.com" rlm_realm: Proxying request from user test1 to realm domain.com rlm_realm: Adding Realm = "domain.com" rlm_realm: Preparing to proxy accounting request to realm "domain.com" ++[suffix] returns updated +- entering group accounting rlm_acct_unique: Hashing '3GPP2-Correlation-Id = "09446618",Acct-Session-Id = "0000000\000",Calling-Station-Id = "77734565"' rlm_acct_unique: Acct-Unique-Session-ID = "e05fa4c07c65ca2b". ++[acct_unique] returns ok expand: %{User-Name} -> test1(a)domain.com rlm_sql (sql): sql_set_user escaped user --> 'test1(a)domain.com' expand: INSERT into radacct (AcctSessionId, AcctUniqueId, CallingStationId, AcctStartTime, AcctStopTime, superkeyActiveTime, AcctInputOctets, AcctOutputOctets, FramedIPAddress, UserName, ReleaseIndicator, superkeyBadPPPFrameCount, superkeyCorrelationId, AcctSessionTime, NASIPAddress) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{Calling-Station-Id}', '%S', NULL,'0', '0', '0', '%{Framed-IP-Address}', trim('%{SQL-User-Name}'), '0', '0', '%{3GPP2-Correlation-Id}', '0', '%{NAS-IP-Address}') -> INSERT into radacct (AcctSessionId, AcctUniqueId, CallingStationId, AcctStartTime, AcctStopTime, superkeyActiveTime, AcctInputOctets, AcctOutputOctets, FramedIPAddress, UserName, ReleaseIndicator, superkeyBadPPPFrameCount, superkeyCorrelationId, AcctSessionTime, NASIPAddress) values('0000000', 'e05fa4c07c65ca2b', '77734565', '2008-04-10 17:08:13', NULL,'0', '0', '0', '192.168.50.19', trim('test1(a)domain.com'), '0', '0', '09446618', '0', '192.168.101.1') rlm_sql (sql): Reserving sql socket id: 24 rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: query affected rows = 1 rlm_sql (sql): Released sql socket id: 24 ++[sql] returns ok +- entering group pre-proxy expand: /var/log/radius/radacct/%{Client-IP-Address}/pre-proxy-detail-%Y%m%d -> /var/log/radius/radacct/192.168.101.1/pre-proxy-detail-20080410 rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/pre-proxy-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.101.1/pre-proxy-detail-20080410 expand: %t -> Thu Apr 10 17:08:13 2008 ++[pre_proxy_log] returns ok Acct-Status-Type = Start User-Name = "test1(a)domain.com" Calling-Station-Id = "77734565" Framed-IP-Address = 192.168.50.19 NAS-IP-Address = 192.168.101.1 Event-Timestamp = "Apr 10 2008 17:08:14 EEST" Acct-Session-Id = "0000000\000" NAS-Port-Type = Virtual NAS-Port = 1813 Acct-Delay-Time = 0 Service-Type = Framed-User Acct-Authentic = RADIUS 3GPP2-ESN = "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" 3GPP2-Attr-116 = 0x0000000000000000000000000000 3GPP2-Correlation-Id = "09446618" 3GPP2-Service-Reference-Id = 0x00000000 3GPP2-Home-Agent-IP-Address = 0.0.0.0 3GPP2-BSID = "2A2100021102" 3GPP2-User-Id = 0 3GPP2-Forward-FCH-Mux-Option = 0 3GPP2-Reverse-FCH-Mux-Option = 0 3GPP2-Service-Option = 59 3GPP2-Forward-Traffic-Type = 0 3GPP2-Reverse-Traffic-Type = 0 3GPP2-FCH-Frame-Size = 0 3GPP2-Forward-FCH-RC = 0 3GPP2-Reverse-FCH-RC = 0 3GPP2-IP-Technology = 1 3GPP2-Compulsory-Tunnel-Indicator = 0 3GPP2-DCCH-Frame-Size = 0 3GPP2-Attr-78 = 0x00000000 3GPP2-Forward-PDCH-RC = 0 3GPP2-Forward-DCCH-Mux-Option = 0 3GPP2-Reverse-DCCH-Mux-Option = 0 3GPP2-Forward-DCCH-RC = 0 3GPP2-Reverse-DHHC-RC = 0 3GPP2-Attr-114 = 0x00000000 3GPP2-IP-QoS = 10 3GPP2-Airlink-Priority = 0 Proxy-State = 0x3937 Proxying request 551 to home server 192.168.0.1 port 1646 Acct-Status-Type = Start User-Name = "test1(a)domain.com" Calling-Station-Id = "77734565" Framed-IP-Address = 192.168.50.19 NAS-IP-Address = 192.168.101.1 Event-Timestamp = "Apr 10 2008 17:08:14 EEST" Acct-Session-Id = "0000000\000" NAS-Port-Type = Virtual NAS-Port = 1813 Acct-Delay-Time = 0 Service-Type = Framed-User Acct-Authentic = RADIUS 3GPP2-ESN = "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" 3GPP2-Attr-116 = 0x0000000000000000000000000000 3GPP2-Correlation-Id = "09446618" 3GPP2-Service-Reference-Id = 0x00000000 3GPP2-Home-Agent-IP-Address = 0.0.0.0 3GPP2-BSID = "2A2100021102" 3GPP2-User-Id = 0 3GPP2-Forward-FCH-Mux-Option = 0 3GPP2-Reverse-FCH-Mux-Option = 0 3GPP2-Service-Option = 59 3GPP2-Forward-Traffic-Type = 0 3GPP2-Reverse-Traffic-Type = 0 3GPP2-FCH-Frame-Size = 0 3GPP2-Forward-FCH-RC = 0 3GPP2-Reverse-FCH-RC = 0 3GPP2-IP-Technology = 1 3GPP2-Compulsory-Tunnel-Indicator = 0 3GPP2-DCCH-Frame-Size = 0 3GPP2-Attr-78 = 0x00000000 3GPP2-Forward-PDCH-RC = 0 3GPP2-Forward-DCCH-Mux-Option = 0 3GPP2-Reverse-DCCH-Mux-Option = 0 3GPP2-Forward-DCCH-RC = 0 3GPP2-Reverse-DHHC-RC = 0 3GPP2-Attr-114 = 0x00000000 3GPP2-IP-QoS = 10 3GPP2-Airlink-Priority = 0 Proxy-State = 0x3937 Going to the next request Waking up in 0.9 seconds. Ignoring request from unknown home server 192.168.0.1 port 1646 ................. Rejecting request 593 due to lack of any response from home server 192.168.0.1 port 1646 Finished request 593. Cleaning up request 593 ID 139 with timestamp +90 Cleaning up request 593 ID 362747136 with timestamp +90 Segmentation fault root@aaa# exit ----- Original Message ---- From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Friday, April 11, 2008 12:59:26 PM Subject: Re: Problem with proxy-radius function Ivan Popov wrote: > What I can say .. > root@aaa:/var/log/radius <mailto:root@aaa:/var/log/radius># tcpdump -i > eth0 host X.X.X.X <sigh> While this is interesting, you were asked for debugging output. > Is It correct? I thing it should be between port 1813 and 1646 ... The traffic looks OK. There may be something else going wrong, and the debug output may show it. Is it possible to run the server in debug mode? If not, why? Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

FR 2.0.3 gives duplicate NULL realm error
by John Horne 11 Apr '08

11 Apr '08

Hello, I have been running FR 2.0.2 (built from source) for a short while with no problems. I have now upgraded to 2.0.3 (built from Fedora 9 source RPM). When I try and start radiusd (using 'radiusd -X' I get the following error: realm NULL { /etc/raddb/proxy.conf[107]: Duplicate realm "NULL" } # realm NULL I have thoroughly checked the files, and there is no duplicate of the NULL realm. The end part of proxy.conf contains the NULL realm, and it is configured as: home_server_pool local_proxies { type = fail-over home_server = IAS-1 home_server = IAS-2 home_server = ILS009 } [other home server pools and realms defined] realm NULL { auth_pool = local_proxies } I'm not sure why the 'radiusd -X' output gives as the very last line '} # realm NULL'. As can be seen in proxy.conf, the very last line has no comment attached to it. Anyone any ideas about why radiusd is complaining about a duplicate NULL realm? Thanks, John. -- --------------------------------------------------------------- John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914 E-mail: John.Horne(a)plymouth.ac.uk Fax: +44 (0)1752 233839

2 5

Problem with LDAP module in 2.0.3 -- Ldap-UserDn unavailable
by Jason Alderfer 11 Apr '08

11 Apr '08

I'm testing upgrading from 1.1.7 to 2.0.3 and have run into a problem with the LDAP module. The problem appears in 2 places. First, I'm using the --with-edir option so I have password_attribute = nspmPassword and edir_account_policy_check = yes set. However, in 2.0.3, when I set "edir_account_policy_check = yes", I get this error: +- entering group post-auth rlm_ldap: User's FQDN not in config items list. ++[ldap] returns fail PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE If I don't set edir_account_policy_check, then authentication is successful, but the second problem shows up. A little background: In 1.1.7 I'm setting VLANs via the 'users' file like this: DEFAULT Ldap-UserDn =~ "ou=is,ou=n,o=emu" Tunnel-Type = "VLAN", Tunnel-Medium-Type = "IEEE-802", Tunnel-Private-Group-Id = 3 and I've tried this in 2.0.3, but I've also tried unlang if (Ldap-UserDn =~ /ou=is,ou=n,o=emu/i) { update reply { Tunnel-Type := "VLAN" Tunnel-Medium-Type := "IEEE-802" Tunnel-Private-Group-Id := 3 } } Neither of these work in 2.0.3. The VLAN does not get set. Files returns noop, and unlang shows in debug output ++? if (Ldap-UserDn =~ /ou=is,ou=n,o=emu/i) (Attribute Ldap-UserDn was not found) I did some digging and I think I know why this is. In rlm_ldap.c beginning at line 1306 is /* * Adding new attribute containing DN for LDAP object associated with * given username */ pairadd(check_pairs, pairmake("Ldap-UserDn", user_dn, T_OP_EQ)); However, in 1.1.7 the code is pairadd(&request->packet->vps, pairmake("Ldap-UserDn", user_dn, T_OP_EQ)); If I add this line to 2.0.3 just after the existing pairadd line and recompile, then everything just works -- edir policy check works and I can set VLANs using files module or unlang. Is this a bug in 2.0.3 or am I missing something in my new config file that would make the Ldap-UserDn available? Jason

1 1

rlm_ldap error
by Jean Frontin 11 Apr '08

11 Apr '08

rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap Hello, I want to receive as Reply-Message carLicense value. When I debug a radiusd session I can see the erro mentionned below (line marked by a star). Have you an idea to eliminate this ? rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP carLicense mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type ... rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... * rlm_ldap: parsing carLicense failed: big brother is watching you Regards -- Jean Frontin System team I R I T Université Paul-Sabatier 118, rte de Narbonne 31062 Toulouse cedex 9 France tel (33)(0)5 61 55 63 03 mail frontin(a)irit.fr

2 1

Re: Problem with proxy-radius function
by Ivan Popov 11 Apr '08

11 Apr '08

What I can say .. root@aaa:/var/log/radius# tcpdump -i eth0 host X.X.X.X 12:38:19.725549 IP aaa.copy.net.1094 > X.X.X.X.1646: RADIUS, Accounting Request (4), id: 0xca length: 387 12:38:19.725660 IP aaa.copy.net.1094 > X.X.X.X.1646: RADIUS, Accounting Request (4), id: 0xa8 length: 589 12:38:19.726122 IP aaa.copy.net.1094 > X.X.X.X.1646: RADIUS, Accounting Request (4), id: 0x26 length: 571 12:38:19.726298 IP aaa.copy.net.1094 > X.X.X.X.1646: RADIUS, Accounting Request (4), id: 0x82 length: 589 12:38:19.755292 IP X.X.X.X.1646 > aaa.copy.net.1094: RADIUS, Accounting Response (5), id: 0xca length: 24 12:38:19.755297 IP X.X.X.X.1646 > aaa.copy.net.1094: RADIUS, Accounting Response (5), id: 0xa8 length: 24 12:38:19.758275 IP X.X.X.X.1646 > aaa.copy.net.1094: RADIUS, Accounting Response (5), id: 0x82 length: 24 12:38:19.761917 X.X.X.X.1646 > aaa.copy.net.1094: RADIUS, Accounting Response (5), id: 0x26 length: 24 Looks like traffic goes between port 1094(my side - different time different) and 1646 Is It correct? I thing it should be between port 1813 and 1646 ... Is It because listen { ipaddr = my.ip.addres port = 0 type = acct } ? P.S On website http://www.freeradius.org/getting.html Link to daily snapshot not work. ftp://ftp.freeradius.org/pub/radius/CVS-snapshots/ ----- Original Message ---- From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Friday, April 11, 2008 12:23:10 PM Subject: Re: Problem with proxy-radius function banga wrote: > AnyOne? > > Error: Rejecting request 20696 due to lack of any response from home server > X.X.X.X port 1646 > Error: Ignoring request from unknown home server X.X.X.X port 1646 > How I can fix that ? I think what's happening is that the home server is sending the response from the wrong port. You would have to show *more* of the debug log to be sure. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

3 2

libpam-radius-auth password problem
by Fabio Pedretti 11 Apr '08

11 Apr '08

I am trying to configure a linux machine (Ubuntu 8.04 alpha, 32 bit) with radius authentication using libpam-radius-auth. I installed freeradius-2.0.3 (from selfbuilded deb package) on the same machine and added this line at the top of users file: testuser Cleartext-Password := "testing" Then I installed libpam-radius-auth 1.3.17-0ubuntu1 from the ubuntu repositories. I added the radius entry in /etc/pam.d/sshd: [...] auth required pam_env.so envfile=/etc/default/locale auth sufficient pam_radius_auth.so debug # Standard Un*x authentication. @include common-auth [...] and this on pam_radius_auth.conf: # server[:port] shared_secret timeout (s) 127.0.0.1 testing123 1 When I try to authenticate with ssh into the machine I noticed that freeradius receive this password "\010\n\r\177INCORRECT", that it's not the one I typed. This is the output of auth.log: Mar 18 18:05:59 test sshd[2533]: pam_radius_auth: Got user name testuser Mar 18 18:05:59 test sshd[2533]: pam_radius_auth: Sending RADIUS request code 1 Mar 18 18:05:59 test sshd[2533]: pam_radius_auth: DEBUG: getservbyname(radius, udp) returned -1211761632. Mar 18 18:06:00 test sshd[2533]: pam_radius_auth: RADIUS server 127.0.0.1 failed to respond Mar 18 18:06:00 test sshd[2533]: pam_radius_auth: All RADIUS servers failed to respond. Mar 18 18:06:00 test sshd[2533]: pam_radius_auth: authentication failed Mar 18 18:06:00 test sshd[2533]: pam_unix(sshd:auth): check pass; user unknown Mar 18 18:06:00 test sshd[2533]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=fabio-mac.local Mar 18 18:06:02 test sshd[2533]: Failed password for invalid user testuser from 10.33.4.8 port 57680 ssh2 This is the output of freeradius -X rad_recv: Access-Request packet from host 127.0.0.1 port 3558, id=65, length=93 User-Name = "testuser" User-Password = "\010\n\r\177INCORRECT" NAS-IP-Address = 127.0.1.1 NAS-Identifier = "sshd" NAS-Port = 2533 NAS-Port-Type = Virtual Service-Type = Authenticate-Only Calling-Station-Id = "fabio-mac.local" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound users: Matched entry testuser at line 50 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated rad_check_password: Found Auth-Type auth: type "PAP" +- entering group PAP rlm_pap: login attempt with password "? INCORRECT" rlm_pap: Using clear text password "testing" rlm_pap: Passwords don't match ++[pap] returns reject auth: Failed to validate the user. Login incorrect (rlm_pap: CLEAR TEXT password check failed): [testuser/\010\n\r\177INCORRECT] (from client localhost port 2533 cli fabio-mac.local) WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> testuser attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 2 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 2 Sending Access-Reject of id 65 to 127.0.0.1 port 3558 Waking up in 4.9 seconds. Cleaning up request 2 ID 65 with timestamp +135 Ready to process requests. Testig with radtest works fine. I noticed a similar problem some time ago, that seemed to be related to 64 bit machines: http://lists.cistron.nl/pipermail/freeradius-users/2006-August/055877.html However I am using a 32 bit machine on an updated system. Where could be the problem? Thanks, Fabio

2 3

Freeradius 2.0.3 crashing when in proxy mode Segmentation fault.
by Vikash Badal 11 Apr '08

11 Apr '08

Greetings, Can you please assist me with this issue. I set up this server to be the authorative radius server for a realm and no issues were encountered Once I set up the server to proxy, the following issue occured. -------------------------------------------------------- Thu Apr 10 06:49:01 2008 : Debug: Finished request 33. Thu Apr 10 06:49:01 2008 : Debug: Cleaning up request 33 ID 170 with timestamp +451 Thu Apr 10 06:49:01 2008 : Debug: Going to the next request Thu Apr 10 06:49:01 2008 : Debug: Waking up in 4.6 seconds. Thu Apr 10 06:49:06 2008 : Error: Rejecting request 31 due to lack of any response from home server 196.26.56.8 port 1646 Thu Apr 10 06:49:06 2008 : Debug: Finished request 31. Thu Apr 10 06:49:06 2008 : Debug: Cleaning up request 31 ID 169 with timestamp +442 Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x28401100 (LWP 100207)] 0x0806417d in cleanup_delay (ctx=0x287fe110) at event.c:477 477 DEBUG2("Cleaning up request %d ID %d with timestamp +%d", (gdb) bt #0 0x0806417d in cleanup_delay (ctx=0x287fe110) at event.c:477 #1 0x080651ae in wait_a_bit (ctx=0x287fe110) at event.c:947 #2 0x08064dec in post_proxy_fail_handler (request=0x287fe110) at event.c:794 #3 0x08064ea5 in no_response_to_proxied_request (ctx=0x287fe110) at event.c:819 #4 0x280c8a9d in fr_event_run (el=0x287fb000, when=0xbfbfe828) at event.c:214 #5 0x280c9078 in fr_event_loop (el=0x287fb000) at event.c:381 #6 0x080681bd in radius_event_process () at event.c:2675 #7 0x0805d376 in main (argc=2, argv=0xbfbfe928) at radiusd.c:394 (gdb) up #1 0x080651ae in wait_a_bit (ctx=0x287fe110) at event.c:947 947 cleanup_delay(request); (gdb) p/x *request $1 = {packet = 0x0, proxy = 0x0, reply = 0x0, proxy_reply = 0x0, config_items = 0x0, username = 0x0, password = 0x0, root = 0x0, data = 0x0, client = 0x0, child_pid = 0x0, timestamp = 0x47fd9c34, number = 0x1f, listener = 0x28495ac0, proxy_listener = 0x28495af0, simul_max = 0x2, simul_count = 0x0, simul_mpp = 0x0, options = 0x0, module = 0x80734f5, component = 0x80734f5, received = {tv_sec = 0x47fd9c34, tv_usec = 0x45fa}, when = {tv_sec = 0x47fd9c42, tv_usec = 0x6f03}, delay = 0x186a0, master_state = 0x1, child_state = 0x6, priority = 0x3, ev = 0x0, next_when = {tv_sec = 0x47fd9c42, tv_usec = 0x6f03}, next_callback = 0x0, in_request_hash = 0x0, in_proxy_hash = 0x0, home_server = 0x0, home_pool = 0x2848a240, proxy_when = {tv_sec = 0x47fd9c34, tv_usec = 0x6f03}, num_proxied_requests = 0x1, num_proxied_responses = 0x0, server = 0x0, parent = 0x0} (gdb) Vikash Please note: This email and its content are subject to the disclaimer as displayed at the following link http://www.is.co.za/legal/E-mail+Confidentiality+Notice+and+Disclaimer.htm. Should you not have Web access, send a mail to disclaimers(a)is.co.za and a copy will be emailed to you.

2 1

short question
by Cristian Novac 11 Apr '08

11 Apr '08

could someone tell me what effect has the following line from the users file if matched: DEFAULT Auth-Type = Local and what's the difference between this line and this one: DEFAULT Auth-Type := Local Thank you!

3 2

proxy requests dependent on length of password
by Sebastian Heil 11 Apr '08

11 Apr '08

Hello everyone, i want to use freeradius as a proxy for other radius-systems. In my environment, i have two backend radius systems for the authentication of the users. the freeradiusserver must decide which packets he will send to which system. the only difference between the packets is the length of the password. for example: radiussystem A gets all the packets with passwords that are 6 characters long radiussystem B gets all the packets with passwords that are 12 characters long Is this possible to realise with freeradius? If yes, how can i do that? I read about the proxy.conf that this works with realms, but i don't have any realms... is there another solution? thanks in advance sebastian -- Psst! Geheimtipp: Online Games kostenlos spielen bei den GMX Free Games! http://games.entertainment.gmx.net/de/entertainment/games/free

2 1

All attributes in rlm_sql_log or rlm_sql ?
by Dean Smith 11 Apr '08

11 Apr '08

Is there a way of using either rlm_sql_log or the post-auth query within rlm_sql to log all the request and/or reply attributes to mysql ? E.g. I could populate one SQL field with a string of the whole packet (just as you would see in the detail log). I would still add my key attributes to named fields but I would like to record "the rest" of the attributes for later reference without having to define a field for every possible attribute I might see. Clearly I could parse/upload the detail files independently but wanted to check if it was possible within the existing framework. Thanks Dean Smith

2 1