- Freeradius-Users - lists.freeradius.org

SQL / replacement of users file
by James Taylor 31 Jan '08

31 Jan '08

Hello list! I think I have an easy one here. I currently am administering several Radius sites for Dynamic VLAN access based on the user id's (HW Address) of workstations. I am wanting to make this process easier to handle and import this data into a SQL database so that I can manage my clients more effectively than using a text based file for the network access control. Is this possible? Can SQL store the appropriate RADIUS information (VLAN ID tags, MAC Address, and Identifiers) so that I don't need to use the USERS file any longer? Any pointers would be greatly appreciated! Thank you all! James

2 1

WPA and EAP-TTLS oddity
by William Bulley 31 Jan '08

31 Jan '08

I swear this has worked for me in the past! Scenario: +-----------------------------------+ | ThinkPad T42 with D-Link DWL-G660 | | (ath0) on FreeBSD 6.2-STABLE | | running wpa_supplicant 0.4.8 | +-----------------------------------+ ^ 802.1X | EAP-TTLS v +---------------------------------------+ | Cisco 1131AG 802.11a/b/g AP IOS 12.4 | +---------------------------------------+ ^ EAP-TTLS | RADIUS v +-----------------------------------+ | FreeRADIUS 1.1.7_2 on FreeBSD 7.0 | +-----------------------------------+ The configs are at the end of this message. It almost works, but the behaviour changes depending on the case (uppercase/lowercase) of the "phase2" value! In both cases below ("auth=PAP" and "auth=pap") the EAP-TTLS session has been established. In one case, I get an ERROR because "PAP" is unknown. In the other case ("pap"), FreeRADIUS cannot locate the cleartext password ("password"). What am I missing? Is this an issue with wpa_supplicant(8) itself? Has anyone gotten EAP-TTLS to work with simple PAP inside the tunnel? About two years ago, I had this working (using PAP inside the tunnel) but it was an early version of wpa_supplicant(8) and probably FreeBSD 4.x or early 5.x =*=*=*=*=*=*=*=*=*= wpa_supplicant.conf =*=*=*=*=*=*=*=*=*=*=*=*= ctrl_interface=/var/run/wpa_supplicant ctrl_interface_group=0 network={ ssid="testing" key_mgmt=WPA-EAP eap=TTLS anonymous_identity="anonymous" identity="foo" password="password" phase2="auth=PAP" } =*=*=*=*=*=*=*=*=*= FreeRADIUS eap.conf =*=*=*=*=*=*=*=*=*=*=*= eap { default_eap_type = ttls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = yes tls { private_key_password = whatever private_key_file = ${raddbdir}/certs/cert-srv.pem certificate_file = ${raddbdir}/certs/cert-srv.pem CA_file = ${raddbdir}/certs/demoCA/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random fragment_size = 1024 include_length = yes cipher_list = "DEFAULT" } ttls { default_eap_type = md5 copy_request_to_tunnel = yes use_tunneled_reply = yes } } =*=*=*=*=*=*=*=*= simplified radiusd.conf =*=*=*=*=*=*=*=*=*=*= [snip] unimportant stuff omitted [/snip] $INCLUDE ${confdir}/clients.conf $INCLUDE ${confdir}/eap.conf instantiate { } authorize { preprocess auth_log eap files pap } authenticate { eap } preacct { preprocess acct_unique } accounting { detail } post-auth { reply_log } =*=*=*=*=*=*=*=*= debug output snippet with phase2="auth=PAP" =*=*=*=*=*=*=*=*=*= rlm_eap_ttls: Session established. Proceeding to decode tunneled attributes. Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 radius_xlat: '/var/log/radacct/127.0.0.1/auth-20080131' rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-%Y%m%d expands to /var/log/radacct/127.0.0.1/auth-20080131 modcall[authorize]: module "auth_log" returns ok for request 5 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 5 users: Matched entry foo at line 217 modcall[authorize]: module "files" returns ok for request 5 modcall[authorize]: module "pap" returns updated for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type pap auth: type "PAP" ERROR: Unknown value specified for Auth-Type. Cannot perform requested action. auth: Failed to validate the user. Trying to look up name of unknown client 127.0.0.1. Login incorrect: [foo/password] (from client UNKNOWN-CLIENT port 260 cli 00-xx-xx-xx-xx-xx) TTLS: Got tunneled Access-Reject rlm_eap: Handler failed in EAP/ttls rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 5 modcall: leaving group authenticate (returns invalid) for request 5 auth: Failed to validate the user. =*=*=*=*=*=*=*=*= debug output snippet with phase2="auth=pap" =*=*=*=*=*=*=*=*=*= rlm_eap_ttls: Session established. Proceeding to decode tunneled attributes. TTLS: Got tunneled identity of foo TTLS: Setting default EAP type for tunneled EAP session. Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 radius_xlat: '/var/log/radacct/127.0.0.1/auth-20080131' rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-%Y%m%d expands to /var/log/radacct/127.0.0.1/auth-20080131 modcall[authorize]: module "auth_log" returns ok for request 5 rlm_eap: EAP packet type response id 6 length 8 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry foo at line 217 modcall[authorize]: module "files" returns ok for request 5 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: EAP Identity rlm_eap: No such EAP type md5 rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 5 modcall: leaving group authenticate (returns invalid) for request 5 auth: Failed to validate the user. Trying to look up name of unknown client 127.0.0.1. Login incorrect: [foo/<no User-Password attribute>] (from client UNKNOWN-CLIENT port 261 cli 00-xx-xx-xx-xx-xx) TTLS: Got tunneled Access-Reject rlm_eap: Handler failed in EAP/ttls TTLS: Freeing handler for user foo rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 5 modcall: leaving group authenticate (returns invalid) for request 5 auth: Failed to validate the user. =*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*= This one has me stumped. :-( Regards, web... -- William Bulley Email: web(a)umich.edu

3 2

Issue reading from detail to sql (buffered-sql virtual server)
by Nick Freeman 31 Jan '08

31 Jan '08

Hi, I'm trying to get my detail file picked up by multiple virtual servers and relayed to multiple PostgreSQL backends. The detail file writes fine, however the detail reader will only ever write one entry to the Postgres DB when it starts. The config I have for the virtual server in question is below: server local_logger { listen { type = detail filename = ${radacctdir}/detail load_factor = 20 } preacct { preprocess acct_unique files } accounting { sql_logger1 } } I have verified that sql_logger1 isn't the problem, if I put that after the detail directive in another virtual server data gets written to the database every time. It looks like my local_logger never picks anything up (except once on startup). Looking at server starting in debug mode I see this: listen { type = "detail" listen { filename = "/var/log/freeradius/radacct/detail" load_factor = 20 } } Is this normal? The listen directive is in the same format as the other virtual servers but this is the only one which has nested listens in the server startup. Thanks in advance, Nick

2 5

radiusd 2.0.1 doesn't process packets
by Sven Lanckmans 31 Jan '08

31 Jan '08

Hi, I'm running 2.0.1 on a Red Hat linux box. I've configured freeradius to listen to ip 10.10.251.200 on eth1 on port 1645. When I do a radsniff I see the packets coming in: [root@pcc8-1 bin]# ./radsniff -i eth1 -p 1645 -X Device: [eth1] PCAP filter: [udp port 1645 or 1646 or 1647] RADIUS secret: [testing123] Packet number 1 has just been sniffed From: 10.10.253.34:21646 To: 10.10.251.200:1645 Type: Access-Request Framed-Protocol = PPP User-Name = "user1(a)vpn1-2.com" User-Password = "\224D\245[\370\\\327p\027y\211\360>£\372." NAS-Port-Type = Virtual NAS-Port = 1610743908 NAS-Port-Id = "6/0/0/2.100" Connect-Info = "speed:vbr:2048" Cisco-AVPair = "client-mac-address=0005.dc39.1548" Service-Type = Framed-User NAS-IP-Address = 10.10.253.34 Acct-Session-Id = "6/0/0/2.100_00000016" NAS-Identifier = "c10c12-2" But when I run radiusd -X, all I see is: > radiusd: #### Opening IP addresses and Ports #### > listen { > type = "auth" > ipaddr = 10.10.251.200 > port = 1645 > } > listen { > type = "acct" > ipaddr = 10.10.251.200 > port = 1646 > } > Listening on authentication address 10.10.251.200 port 1645 > Listening on accounting address 10.10.251.200 port 1646 > Ready to process requests. Nothing else happens. lsof shows that radiusd is listening on the correct ports: > radiusd 1698 root 5u IPv4 2177523 UDP > 10.10.251.200:1645 > radiusd 1698 root 6u IPv4 2177525 UDP > 10.10.251.200:1646 > radiusd 1698 root 7u IPv4 2177526 UDP > 10.10.251.200:1647 What could I be missing? Why is radiusd not seeing the packets flowing to these ports, but radsniff is? Thanks, Sven.

2 1

2.0.1 Segfault
by Michael J. Hartwick 31 Jan '08

31 Jan '08

Hi, I know that this post may not contain all of the required information, this is just to get things going while I investigate further. I have had a problem with FreeRADIUS segfaulting intermittently for a number of months which makes it hard to gather the required information. The only thing that I found in all cases was the numerous, empty Cisco-AVPair's in the packet. With it being a segfault I suspect accessing a null pointer somewhere. I have captured a packet that is causing this to occur and sure enough it contains the numerous, empty Cisco-AVPair's. I have started it in gdb now, the output of bt is below. rad_recv: Accounting-Request packet from host w.x.y.z port 2903, id=213, length=362 Service-Type = Framed-User Cisco-AVPair = "" Cisco-AVPair = "" Cisco-AVPair = "" Cisco-AVPair = "" Cisco-AVPair = "" Cisco-AVPair = "" Cisco-AVPair = "" Cisco-AVPair = "" Cisco-AVPair = "" Cisco-AVPair = "" Cisco-AVPair = "" Cisco-AVPair = "" Cisco-AVPair = "" Cisco-AVPair = "" Cisco-AVPair = "" Cisco-AVPair = "" Cisco-AVPair = "" Cisco-AVPair = "" NAS-Port-Type = Async Connect-Info = "3120" Calling-Station-Id = "NPANXXxxxx" X-Ascend-PreSession-Time = 41 X-Ascend-Disconnect-Cause = Remote-End-Hung-Up Acct-Session-Id = "00004E39" Acct-Session-Time = 114 Framed-IP-Address = W.X.Y.Z Acct-Link-Count = 1 Acct-Authentic = RADIUS User-Name = "test(a)test.com" NAS-Port = 1060 Called-Station-Id = "yyyxxxx" Framed-Protocol = PPP Acct-Terminate-Cause = User-Request Acct-Input-Packets = 53 Acct-Output-Packets = 39 X-Ascend-Data-Rate = 26400 Acct-Delay-Time = 0 Acct-Input-Octets = 1431 Login-Service = PortMaster Acct-Output-Octets = 9084 X-Ascend-Modem-SlotNo = 6 X-Ascend-Xmit-Rate = 31200 Acct-Status-Type = Stop Segmentation fault 0x40297d8f in memcpy () from /lib/libc.so.6 (gdb) bt #0 0x40297d8f in memcpy () from /lib/libc.so.6 #1 0x400289c1 in rad_attr2vp (packet=0x8177678, original=0x0, secret=0x8169168 "secret", attribute=90, length=0, data=0x817887c "\004\006\n\001\001\226x\006\001\005") at radius.c:1953 #2 0x40028df4 in rad_decode (packet=0x8177678, original=0x0, secret=0x8169168 "secret") at radius.c:2386 #3 0x080539d4 in client_socket_decode (listener=0x8174960, request=0x8178898) at listen.c:697 #4 0x0805faab in request_pre_handler (request=0x8178898) at event.c:995 #5 0x08061e2d in radius_handle_request (request=0x8178898, fun=0x804d2b0 <rad_accounting>) at event.c:2701 #6 0x0805ad21 in thread_pool_addrequest (request=0xffffffff, fun=0x8179f04) at threads.c:860 #7 0x08061510 in event_socket_handler (xel=0x8174f98, fd=13, ctx=0x8179f04) at event.c:2340 #8 0x40030c23 in fr_event_loop (el=0x8174f98) at event.c:412 #9 0x08061e03 in radius_event_process () at event.c:2696 #10 0x0805968f in main (argc=2, argv=0x2) at radiusd.c:381 #11 0x4022fd06 in __libc_start_main () from /lib/libc.so.6 I *think* that the problem might be the length=0 in the call to rad_attr2vp(). If that is the case then something like: if (length = 0) return NULL; at line 1928 or so of radius.c might resolve the problem. Before I go ahead and make that addition, am I on the right page or way off in left field on this? Michael ---------------------------------------------------------------------- Michael J. Hartwick, VE3SLQ hartwick(a)hartwick.com Hartwick Communications Consulting (519) 396-7719 Kincardine, ON, CA http://www.hartwick.com ----------------------------------------------------------------------

2 3

FR2: combining round-robin and fail-over home server pools
by John Horne 31 Jan '08

31 Jan '08

Hello, I am in the process of configuring FreeRADIUS 2.0.1. For some realms we proxy the authentication request to three other servers (svr-1, svr-2, svr-3). However, what we wanted was to, in effect, round-robin two of the servers (svr1 and svr-2), and then only use the third server (svr-3) if the other two were not available. I have configured the proxy.conf 'home_server_pool's as: home_server_pool local_IAS { type = client-port-balance home_server = svr-1 home_server = svr-2 } home_server_pool local_proxies { type = fail-over home_server = local_IAS home_server = svr-3 } Note that 'local_IAS' is actually a home_server_pool name, and not an actual home server. I was then going to configure FR to use 'local_proxies' for the relevant realms. However, starting FR gives an error: /usr/local/etc/raddb/proxy.conf[87]: Unknown home_server "local_IAS". Anyone any ideas how to mix round-robin servers with fail-over? Thanks, John. -- --------------------------------------------------------------- John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914 E-mail: John.Horne(a)plymouth.ac.uk Fax: +44 (0)1752 233839

2 1

Terminate EAP-PEAP client connection at FreeRadius Proxy and proxy (forward) request as PAP
by Joakim Lindgren 31 Jan '08

31 Jan '08

Hi all (and really thanks to Alan DeKok), I have a complete EAP-PEAP/TLS/TTLS configuration working against FreeRadius and IAS. A software I´m using is offering two factor authentication and they got their own Radius who only supports PAP. Is it possible to terminate the client EAP connection at the FreeRadius proxy and forward the request as a PAP to the software vendors own Radius. In that case it works, briefly how do I do? Thanks all! (Im going to buy Alan DeKok coming FreeRadius book ;-) Sincerely Joakim

3 2

radiusd service do not start
by Nicolas 31 Jan '08

31 Jan '08

Hi, I installed freeradius to manage the wifi network of our organization (17 wifi ap) It works well when launched in command line (radiusd X), but I cant make it work as a service, Service radiusd start seems to work, but radius close immediately after, so a status will say that radiusd is dead, but subsys is locked. Here is the output of the radius X : # radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1812 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "nobody" main: group = "nobody" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms listen: port = 1812 listen: type = "auth" listen: port = 1813 listen: type = "acct" radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = yes eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/wifi.dasilva.int.pem" tls: certificate_file = "/etc/raddb/certs/wifi.dasilva.int.pem" tls: CA_file = "/etc/raddb/certs/root.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls peap: default_eap_type = "tls" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (auth_log) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. I dont see any errors in that, and I cant seem to find a solution via google. Fiy, the identification is done by certificates. Nicolas INNOCENT Resp. Informatique Groupe Da Silva ----------------------------------------------------- Tél : 05 62 20 41 31 Fax : 05 62 20 60 04 @ : sysadmin(a)groupe-dasilva.com Site web : <http://www.dasilva.fr/> http://www.dasilva.fr/ -----------------------------------------------------

2 2

Fwd: cannot connect to sql databse
by Devinder Singh 31 Jan '08

31 Jan '08

Hi I am using Dial Up Admin on Free radius Free Radius is Running but when i acccess Dial Up admin page i get cannot connect to sql databse I have done most of the configuration settings and followed the wiki tutorial on Free Radius. Please help as i want to get the Dial Up Admin Page to work. Thank you. -- Devinder -- Devinder

6 22

Re: trouble seting up freeradius :((
by SnahaD00 30 Jan '08

30 Jan '08

SnahaD00 wrote: > When I issue command freeradius -x i got this: > rlm_eap_tls: Loading the certificate file as a chain > rlm_eap: SSL error error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt The password you put in the configuration file is not the same as the password used to create the private key. Alan DeKok. Ok. Got this part working. Now another thing or two: - installing certificates on windows xp box ? - creating my own cretificate - how to or better walk through ? Snaha

1 0