- Freeradius-Users - lists.freeradius.org

Re: Freeradius 2.0.3 crashing when in proxy mode Segmentation fault.
by Ivan Popov 10 Apr '08

10 Apr '08

Can confirm that, I Use 2.0.3 - snapshort-04072008 I Will try to ask second side to change port of answer from 1646 to 1813 , but dont think that this avoid Segmentation fault. Finished request 797. Cleaning up request 797 ID 92 with timestamp +131 Going to the next request Waking up in 0.3 seconds. Rejecting request 602 due to lack of any response from home server X.X.X.X port 1646 Finished request 602. Cleaning up request 602 ID 152 with timestamp +102 Cleaning up request 602 ID 0 with timestamp +102 Segmentation fault ----- Original Message ---- From: Vikash Badal <Vikash.Badal(a)is.co.za> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Thursday, April 10, 2008 10:15:53 AM Subject: Freeradius 2.0.3 crashing when in proxy mode Segmentation fault. Greetings, Can you please assist me with this issue. I set up this server to be the authorative radius server for a realm and no issues were encountered Once I set up the server to proxy, the following issue occured. -------------------------------------------------------- Thu Apr 10 06:49:01 2008 : Debug: Finished request 33. Thu Apr 10 06:49:01 2008 : Debug: Cleaning up request 33 ID 170 with timestamp +451 Thu Apr 10 06:49:01 2008 : Debug: Going to the next request Thu Apr 10 06:49:01 2008 : Debug: Waking up in 4.6 seconds. Thu Apr 10 06:49:06 2008 : Error: Rejecting request 31 due to lack of any response from home server 196.26.56.8 port 1646 Thu Apr 10 06:49:06 2008 : Debug: Finished request 31. Thu Apr 10 06:49:06 2008 : Debug: Cleaning up request 31 ID 169 with timestamp +442 Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x28401100 (LWP 100207)] 0x0806417d in cleanup_delay (ctx=0x287fe110) at event.c:477 477 DEBUG2("Cleaning up request %d ID %d with timestamp +%d", (gdb) bt #0 0x0806417d in cleanup_delay (ctx=0x287fe110) at event.c:477 #1 0x080651ae in wait_a_bit (ctx=0x287fe110) at event.c:947 #2 0x08064dec in post_proxy_fail_handler (request=0x287fe110) at event.c:794 #3 0x08064ea5 in no_response_to_proxied_request (ctx=0x287fe110) at event.c:819 #4 0x280c8a9d in fr_event_run (el=0x287fb000, when=0xbfbfe828) at event.c:214 #5 0x280c9078 in fr_event_loop (el=0x287fb000) at event.c:381 #6 0x080681bd in radius_event_process () at event.c:2675 #7 0x0805d376 in main (argc=2, argv=0xbfbfe928) at radiusd.c:394 (gdb) up #1 0x080651ae in wait_a_bit (ctx=0x287fe110) at event.c:947 947 cleanup_delay(request); (gdb) p/x *request $1 = {packet = 0x0, proxy = 0x0, reply = 0x0, proxy_reply = 0x0, config_items = 0x0, username = 0x0, password = 0x0, root = 0x0, data = 0x0, client = 0x0, child_pid = 0x0, timestamp = 0x47fd9c34, number = 0x1f, listener = 0x28495ac0, proxy_listener = 0x28495af0, simul_max = 0x2, simul_count = 0x0, simul_mpp = 0x0, options = 0x0, module = 0x80734f5, component = 0x80734f5, received = {tv_sec = 0x47fd9c34, tv_usec = 0x45fa}, when = {tv_sec = 0x47fd9c42, tv_usec = 0x6f03}, delay = 0x186a0, master_state = 0x1, child_state = 0x6, priority = 0x3, ev = 0x0, next_when = {tv_sec = 0x47fd9c42, tv_usec = 0x6f03}, next_callback = 0x0, in_request_hash = 0x0, in_proxy_hash = 0x0, home_server = 0x0, home_pool = 0x2848a240, proxy_when = {tv_sec = 0x47fd9c34, tv_usec = 0x6f03}, num_proxied_requests = 0x1, num_proxied_responses = 0x0, server = 0x0, parent = 0x0} (gdb) Vikash Please note: This email and its content are subject to the disclaimer as displayed at the following link http://www.is.co.za/legal/E-mail+Confidentiality+Notice+and+Disclaimer.htm. Should you not have Web access, send a mail to disclaimers(a)is.co.za and a copy will be emailed to you. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

Re: Modifying User-Name and User-Password attributes in a module
by Stefan Winter 10 Apr '08

10 Apr '08

> > update request { > > User-Name := whatever > > User-Password := wh4t3v3r > > } > > > > in the pre-proxy section work? No need for a module then... And if I may > > ask, why would you need to modify name and password for proxying? If it's > > just about cutting out realms, there is an excellent realm module to do > > that for you. > > Yes, I can do that for static modifications, but in my case I have to > split the password and extract N bytes from it, which is a One-time > password for 2 factor authentication. I have to receive AUTH_ACK from > main radius server using the original password and then process the > second authentication stage with a 2 factor authentication manager using > that N bytes long OTP. (Connecting to 2FA server, sending OTP and > receiving result) This is why I need to do it in a module. unlang can do WAY more than just static replacements. Use a regular expression. if ( %{request:User-Password} =~ (.*)(......) ) update request { User-Password := %{2} } ... or something close to that. My syntax may be imperfect, maybe someone can provide a more bullet-proof/correct one. This here is supposed to mean: if the password is at least 6 characters long, change the password so that it only is those last six characters (%{1} would be: only the first part, without the trailing OTP). If it is less than six, this expression does nothing. I guess in your scenario you would want to discard those outright, because they don't contain a valid OTP. Add another rule for this case then. I'm ssuming your "N" to be = 6 because that's a common length for OTPs. Put more/less dots at the end of the regexp if you have a different setup. > Now, any ideas on which of the user-password vp's I have to change ? I'm trying to prepare you for the tough conclusion that you may not need any code changes here at all. That's why I changed the recipient to -users, not -devel. > I know this is ugly. So, If I define my own attributes, is it necessary > for main RADIUS server (which we proxy to) to have modified dictionary > files ? or it will simply ignore those unknown attributes ? It should. See RFC2865 section 5.26 and RFC5080 section 2.5 for details. But, to be honest, the pragmatically best approach is: TRY IT. Define a VSA, send it, and look what happens. Greetings, Stefan Winter -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

1 0

Re: Authenticate with FreeRadius + MySQL + PEAP
by tiodacio 09 Apr '08

09 Apr '08

Hi list, The problem was just the client (XP SP2). I change the client (Windows Vista) and it works (thanks Ivan). There is a hotfix for the problem in Micro$oft support website http://support.microsoft.com/kb/885453/en-us, but i installed it in XP and dont have success. Does anyone knows how to fix this problem with XP SP2? Thanks, Dácio ---------- Início da mensagem original ----------- De: freeradius-users-bounces+tiodacio=bol.com.br(a)lists.freeradius.org Para: "FreeRadius users mailing list" freeradius-users(a)lists.freeradius.org Cc: Data: Tue, 08 Apr 2008 19:25:46 +0100 Assunto: Re: Authenticate with FreeRadius + MySQL + PEAP > Try another client or JRadius Simulator. > > Ivan Kalik > Kalik Informatika ISP > > > Dana 8/4/2008, "tiodacio" <tiodacio(a)bol.com.br> pise: > > >Clear-text > > > >---------- Início da mensagem original ----------- > > > > De: freeradius-users-bounces+tiodacio=bol.com.br(a)lists.freeradius.org > > Para: "FreeRadius users mailing list" freeradius-users(a)lists.freeradius.org > > Cc: > > Data: Tue, 08 Apr 2008 18:51:42 +0100 > > Assunto: Re: Authenticate with FreeRadius + MySQL + PEAP > > > >> >I think thats some problem with eap-peap, because when i use radtest to authenticate test(a)some.domain.com the authentication proceeds. > >> > > >> > >> Is that password in the database encrypted or in clear text? > >> > >> Ivan Kalik > >> Kalik Informatika ISP > >> > >> - > >> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > >> > > > > > >- > >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >

1 0

EAP-TLS authentication with FreeRADIUS 2.0
by Erik Norgaard 09 Apr '08

09 Apr '08

Hi: I run FreeRADIUS 2.0 for EAP-TLS authentication on my wireless network, it works fine in my test setup but there are some pieces missing I can't figure out: 1. I'd like to add support for more than one root certificate 2. I'd like to log the certificate's distinguished name 3. I'd like to add a LDAP backend for further authentication The point is that I don't mind sharing my network as long as I know who people are, and it would release me of some certificate management if I can just add CA certificates. I'd like to log the distinguished name, as it is better when multiple CAs are used. It would be nice too, also to store a copy of any user certificate submitted, or log both email, distinguished name and possibly certificate serial number. I'd like the LDAP backend in order to add extra information for each user and possibly block a user without revoking the certificate, and other management tasks. Is this possible? Thanks, Erik -- Erik Nørgaard Ph: +34.666334818 http://www.locolomo.org

2 1

Auth problem with password
by Mendel Mathieu 09 Apr '08

09 Apr '08

Hi, First sorry for my english... So we have a freeradius server and we have a problem of authentification. Sometimes we received in the log this kind of password if the user try to relog 2 or 3 times the log was successful but sometimes it don't work at all. For exemple : Auth: Login incorrect: [176384/3\226\336[\303\306\022\327\354\227\2215\241\3004y] (from client jm port 3 cli 00-40-CA-DE-17-78) Auth: Login OK: [176384/508830] (from client jm port 3 cli 00-40-CA-DE-17-78) Somebody have an idea why my password was received like that ?? Thanks a lot. -- Mendel Mathieu

1 0

Using tags (RFC2868)
by Imri Zvik 09 Apr '08

09 Apr '08

Hi, I'm trying to use tags, in order to group tunneling attributes. I've tried adding them like that: Tunnel-Preference:0 += "10" Tunnel-Preference:1 += "10" But when running the radius in debug mode (-X -x), I see that the following is being returned to the NAS: Sending Access-Accept of id 74 to 213.8.9.XXX port 21693 (....) Tunnel-Preference:0 += 10 Tunnel-Preference:0 += 10 Any ideas why?

2 3

SHA1 password, ldap authentication.
by antoine vallée 09 Apr '08

09 Apr '08

HI, Does anybody knows if ldap can make the authentication by itslef instead of radius? because my password a stored in sha in the ldap database, and i really nead to do md5. Certs can't bu used because it needs a PKI and it's not possible as well as eap-ttls because it requires securew2 (there's no eap-ttls module natively in windows) and we can't forced visitors to install a software in order to have access to some local ressources. So the only solution is eap-md5... I've heard something about ldap, that maybe it's possible to give the cleartext password to the ldap, then the ldap will find the shapassword and return to the radius server a message for the authentication. Is this possible? If so, how can I do that? Because last time, i've been told that the only solution to do login/pwd authentication was eap-ttls+securew2 (for xp) or to store my password in cleartext in the ldap database.. but they're both inapropriate. any ideas on the subject? Thanks, Antoine. _________________________________________________________________ Découvrez les profils Messenger de vos amis ! http://home.services.spaces.live.com/

2 1

Configuring multiple, chained EAP methods (i.e. EAP-TTLS-EAP-MD5-EAP-TNC)
by ingo.bente＠inform.fh-hannover.de 09 Apr '08

09 Apr '08

Hi, is it possible to configure multiple eap methods that must all be executed for a user? I.e., I am thinking of something like: - establish a TTLS tunnel - do EAP-MD5 for user authentication - do EAP-TNC for platform authentication Currently, I just managed to do either EAP-MD5 or EAP-TNC inside the TTLS tunnel, not both. I see no option in the config files where multiple eap methods can be added. Thanks, Ingo

2 1

Re: Authenticate with FreeRadius + MySQL + PEAP
by tiodacio 08 Apr '08

08 Apr '08

Clear-text ---------- Início da mensagem original ----------- De: freeradius-users-bounces+tiodacio=bol.com.br(a)lists.freeradius.org Para: "FreeRadius users mailing list" freeradius-users(a)lists.freeradius.org Cc: Data: Tue, 08 Apr 2008 18:51:42 +0100 Assunto: Re: Authenticate with FreeRadius + MySQL + PEAP > >I think thats some problem with eap-peap, because when i use radtest to authenticate test(a)some.domain.com the authentication proceeds. > > > > Is that password in the database encrypted or in clear text? > > Ivan Kalik > Kalik Informatika ISP > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >

2 1

Re: Authenticate with FreeRadius + MySQL + PEAP
by tiodacio 08 Apr '08

08 Apr '08

Ivan, Thats the problem, i have sure the password its not wrong. The users test and test(a)some.domain.com have the same password. The first is authenticated, the second no. The problem is when my user has a domain and i need a domain because my radius will make proxy. I think thats some problem with eap-peap, because when i use radtest to authenticate test(a)some.domain.com the authentication proceeds. Dácio ---------- Início da mensagem original ----------- De: freeradius-users-bounces+tiodacio=bol.com.br(a)lists.freeradius.org Para: "FreeRadius users mailing list" freeradius-users(a)lists.freeradius.org Cc: Data: Tue, 08 Apr 2008 15:41:01 +0100 Assunto: Re: Authenticate with FreeRadius + MySQL + PEAP > >modcall: entering group MS-CHAP for request 6 > > rlm_mschap: Told to do MS-CHAPv2 for teste(a)unesp.br with NT-Password > > rlm_mschap: FAILED: MS-CHAP2-Response is incorrect > > > > Password is wrong. > > Ivan Kalik > Kalik Informatika ISP > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >

2 1