- Freeradius-Users - lists.freeradius.org

Setting radiusd user/cert permissions in Mac OSX
by Info 30 Jan '08

30 Jan '08

Good afternoon, When setting user/group to "nobody" in radiusd.conf, I get some permissions problems with loading the certs and just wanted to know how to properly set them to avoid this: rlm_eap: SSL error error:0200100D:system library:fopen:Permission denied rlm_eap_tls: Error reading certificate file /opt/local/etc/raddb/ certs/server.pem rlm_eap: Failed to initialize type tls Thanks for answering the, no doubt, simplest of questions ! Jim P.S: The above output is from testing with radiusd -X ___________________________________________________ James H. Graham II, Creative Director • Spark Media Group 6511 Allegheny Avenue • Takoma Park, MD 20912-4737 Tel: 301.270.4810 • Fax: 301.270.4812 • www.sparkmediagroup.com

2 1

anyone provide consulting services to setup a radius server?
by Chad Whitten 30 Jan '08

30 Jan '08

Very simple setup - 1 server - novell suse enterprise 10.0, 1 nas - Lucent TNT, 700 or so users - all dialup. Would like to use a mysql database to store usernames and passwords and use the freeradius dialupdamin web tool for management of users. NAS is currently authenticating against a remote freeradius server that just uses unix passwd/shadow files. If anyone is interested in some light consulting work to do this, please let me know. Thanks -- Chad Whitten Metro Network Solutions (601) 366-6630 Phone (601) 366-6066 Fax (601) 842-6804 Cellular (601) 519-4172 Pager cwhitten(a)metronetsys.com

1 0

need help in using free radius
by johnson elangbam 30 Jan '08

30 Jan '08

Hi, When I first run the free Radius using the command "radtest test test localhost 0 testing123" i found the following errors. Please help rad_recv: Access-Request packet from host 127.0.0.1 port 32775, id=80, length=56 User-Name = "test" User-Password = "test" NAS-IP-Address = 192.168.1.227 NAS-Port = 0 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication m ay fail because of this. ++[pap] returns noop auth: No authenticate method (Auth-Type) configuration found for the request: Re jecting the user auth: Failed to validate the user. Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> test attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 80 to 127.0.0.1 port 32775 Waking up in 4.9 seconds. Cleaning up request 0 ID 80 with timestamp +31 Ready to process requests. With Regards, Elangbam Johnson

3 2

Re: sql accounting - no records - 2.0.1 RESOLVED
by Andrew Long 30 Jan '08

30 Jan '08

I expected to see some traffic too soon, now it's coming... but where are the accounting queries? Andrew On Jan 30, 2008 8:52 AM, Andrew Long <fursink(a)gmail.com> wrote: > I've just installed 2.0.1 on CentOS 5 with MySQL 5.x. I can get the > clients to authenticate and I see accounting requests come in, also I > see the accounting query as it should be updated to mysql, i.e., > "expand: UPDATE radacct...". I also see the accounting response > returned to the client, but no accounting records are being updated in > radacct table. There are no errors in debug mode relevent to mysql: > > rlm_sql (sql): received Acct On/Off packet > expand: %{Acct-Delay-Time} -> 0 > expand: UPDATE radacct SET > acctstoptime = '%S', acctsessiontime = > unix_timestamp('%S') - > unix_timestamp(acctstarttime), acctterminatecause = > '%{Acct-Terminate-Cause}', acctstopdelay = > %{%{Acct-Delay-Time}:-0} WHERE acctsessiontime = 0 > AND acctstoptime = NULL AND nasipaddress = > '%{NAS-IP-Address}' AND acctstarttime <= '%S' -> > UPDATE radacct SET acctstoptime = > '2008-01-30 07:45:06', acctsessiontime = > unix_timestamp('2008-01-30 07:45:06') - > unix_timestamp(acctstarttime), acctterminatecause = > '', acctstopdelay = 0 WHERE > acctsessiontime = 0 AND acctstoptime = NULL > AND nasipaddress = '141.xxx.xxx.xxx' AND acctstarttime > <= '2008-01-30 07:45:06' > rlm_sql (sql): Reserving sql socket id: 2 > rlm_sql (sql): Released sql socket id: 2 > ++[sql] returns ok > expand: %{User-Name} -> elmaroma_cn3000 > attr_filter: Matched entry DEFAULT at line 12 > ++[attr_filter.accounting_response] returns updated > Sending Accounting-Response of id 33 to 141.xxx.xxx.xxx port 1025 > > I have tried this with 2 different clients and get the same NULL > result. Authentication is fine, but any features relying on data in > radacct clearly won't work, ie session-timout... > > I've checked the "default" config, and all accounting is set to sql. > The one oddity I notice is that "default" has: > # See "Accounting queries" in sql.conf > sql > > But I can see no accounting queries anywhere in the provided sql.conf ?? > > Thank You. > > Andrew Long > EWS Solutions >

2 1

Problems using EAP-TLS with freeradius version 2
by Stefan Puch 30 Jan '08

30 Jan '08

Hello everyone, I've got some problems with the new version of freeradius, but before I'm going to open a new bugreport or post long debugtraces from "radiusd -X" I want to ask here if someone else has made similar experiences. I've set up a freeradius server version 1.1.7 in our club to authenticate several Notebooks. This worked fine with Windows XP, Windows Vista and Linux clients using EAP-TLS certificates (many thanks for the good documentation of the OIDs in the TLS certificate). Then some people came with their mobile devices which are running Windows Mobile 2003, Windows Mobile 5 (WM5) or Windows Mobile6 (WM6) and the problems began. The same EAP-TLS certificate which worked fine on a Windows XP machine doesn't work on e.g. Windows Mobile 6 PDA. So first I updated the freeradius version to the latest release (2.0.1), checked and modified all configuration files and so on, but that didn't solve the problem, it made them getting worser. With the new version 2.0.1 the Windows and Linux Laptops are not able to authenticate any more with the freeradius server (the certificates are still the same). The server sends an ACCESS, but the behavior is like described in the FAQ "PEAP or EAP-TLS Doesn't Work with a Windows machine". Downgrading to the previous version of freeradius 1.1.7 makes them work again, freeradius version 2.0.0 doesn't work either. Does anyone of the experts here know what could be the problem (a guess, perhaps what changed from version 1.1.7 to version 2.0.1)? My goal is first to make the clients using Windows XP, Vista and Linux work again with freeradius version2 and EAP-TLS. After fixing that it would be fine, if freeradius would also work the different Windows Mobile systems. So, what would be helpful to analyze the problem? All config files or just the output from radiusd -X from both versions in order to make a diff or should I open a new bug in the tracking system as well? I would like to provide USEFULL debug-traces, so that it is easier for the experts to solve the problem and not to much work for me when providing useless informations. Best regards and thanks in advance Stefan Puch

3 2

memory corruption when proxying accounting requests
by Jørn Kostøl 30 Jan '08

30 Jan '08

Hi, Im having problems proxying accounting requests on FreeRadius 2. Local auth and acct works fine, and proxying auth works. But as soon as I try to proxy accounting then Freeradius crashes. I have tried proxying to an old stable freeradius server, through a home server, direct to a virtual server, home server pools, and I have tried to add and remove all the modules and options I can to try to find if there is a particular part that makes it crash but no luck. The accounting requests gets sent, and FreeRadius crashes after. Ive tried to install both version FreeRadius 2.0.0 and 2.0.1 on two different servers both running different Ubuntu versions. Anyone have an idea what I can try next? Here is output from one of the installations: *** glibc detected *** ../../sbin/radiusd: malloc(): memory corruption: 0x081b7460 *** ======= Backtrace: ========= /lib/tls/i686/cmov/libc.so.6[0xb7c7c1cd] /lib/tls/i686/cmov/libc.so.6(malloc+0x7f)[0xb7c7d83f] /usr/local/freeradius2/lib/libfreeradius-radius-2.0.1.so(paircopy2+0x69)[0xb 7f503d9] /usr/local/freeradius2/lib/libfreeradius-radius-2.0.1.so(paircopy+0x25)[0xb7 f50475] ../../sbin/radiusd[0x806150d] ../../sbin/radiusd(radius_handle_request+0x5b)[0x806160b] ../../sbin/radiusd(thread_pool_addrequest+0x36)[0x805bd56] ../../sbin/radiusd[0x8060c32] /usr/local/freeradius2/lib/libfreeradius-radius-2.0.1.so(fr_event_loop+0x236 )[0xb7f53db6] ../../sbin/radiusd(radius_event_process+0x30)[0x80624e0] ../../sbin/radiusd(main+0x572)[0x805ad52] /lib/tls/i686/cmov/libc.so.6(__libc_start_main+0xdc)[0xb7c2a8cc] ../../sbin/radiusd[0x804d1f1] ======= Memory map: ======== 08048000-08076000 r-xp 00000000 08:07 326643 /usr/local/freeradius2/sbin/radiusd 08076000-08078000 rw-p 0002d000 08:07 326643 /usr/local/freeradius2/sbin/radiusd 08078000-081d3000 rw-p 08078000 00:00 0 [heap] b7800000-b7821000 rw-p b7800000 00:00 0 b7821000-b7900000 ---p b7821000 00:00 0 b79ab000-b79b5000 r-xp 00000000 08:01 144592 /lib/libgcc_s.so.1 b79b5000-b79b6000 rw-p 00009000 08:01 144592 /lib/libgcc_s.so.1 b79bb000-b79bd000 r-xp 00000000 08:07 326401 /usr/local/freeradius2/lib/rlm_attr_filter-2.0.1.so b79bd000-b79be000 rw-p 00001000 08:07 326401 /usr/local/freeradius2/lib/rlm_attr_filter-2.0.1.so b79be000-b79e2000 r-xp 00000000 08:01 144858 /lib/tls/i686/cmov/libm-2.4.so b79e2000-b79e4000 rw-p 00023000 08:01 144858 /lib/tls/i686/cmov/libm-2.4.so b79e4000-b7b73000 r-xp 00000000 08:07 505387 /usr/lib/libmysqlclient_r.so.15.0.0 b7b73000-b7bb7000 rw-p 0018e000 08:07 505387 /usr/lib/libmysqlclient_r.so.15.0.0 b7bb7000-b7bb8000 rw-p b7bb7000 00:00 0 b7bba000-b7bbc000 r-xp 00000000 08:07 326391 /usr/local/freeradius2/lib/rlm_acct_unique-2.0.1.so b7bbc000-b7bbd000 rw-p 00001000 08:07 326391 /usr/local/freeradius2/lib/rlm_acct_unique-2.0.1.so b7bbd000-b7bbf000 r-xp 00000000 08:07 326608 /usr/local/freeradius2/lib/rlm_sql_mysql-2.0.1.so b7bbf000-b7bc0000 rw-p 00001000 08:07 326608 /usr/local/freeradius2/lib/rlm_sql_mysql-2.0.1.so b7bc0000-b7bc8000 r-xp 00000000 08:07 326613 /usr/local/freeradius2/lib/rlm_sql-2.0.1.so b7bc8000-b7bc9000 rw-p 00007000 08:07 326613 /usr/local/freeradius2/lib/rlm_sql-2.0.1.so b7bc9000-b7bcb000 r-xp 00000000 08:07 326598 /usr/local/freeradius2/lib/rlm_realm-2.0.1.so b7bcb000-b7bcc000 rw-p 00001000 08:07 326598 /usr/local/freeradius2/lib/rlm_realm-2.0.1.so b7bcc000-b7bce000 r-xp 00000000 08:07 326583 /usr/local/freeradius2/lib/rlm_preprocess-2.0.1.so b7bce000-b7bcf000 rw-p 00002000 08:07 326583 /usr/local/freeradius2/lib/rlm_preprocess-2.0.1.so b7bcf000-b7bd1000 r-xp 00000000 08:07 326411 /usr/local/freeradius2/lib/rlm_chap-2.0.1.so b7bd1000-b7bd2000 rw-p 00001000 08:07 326411 /usr/local/freeradius2/lib/rlm_chap-2.0.1.so b7bd2000-b7bd5000 r-xp 00000000 08:07 326567 /usr/local/freeradius2/lib/rlm_pap-2.0.1.so b7bd5000-b7bd6000 rw-p 00003000 08:07 326567 /usr/local/freeradius2/lib/rlm_pap-2.0.1.so b7bd6000-b7bd9000 r-xp 00000000 08:07 326551 /usr/local/freeradius2/lib/rlm_logintime-2.0.1.so b7bd9000-b7bda000 rw-p 00002000 08:07 326551 /usr/local/freeradius2/lib/rlm_logintime-2.0.1.so b7bda000-b7bdc000 r-xp 00000000 08:07 326514 /usr/local/freeradius2/lib/rlm_expiration-2.0.1.so b7bdc000-b7bdd000 rw-p 00001000 08:07 326514 /usr/local/freeradius2/lib/rlm_expiration-2.0.1.so b7bdd000-b7be0000 r-xp 00000000 08:07 326519 /usr/local/freeradius2/lib/rlm_expr-2.0.1.so b7be0000-b7be1000 rw-p 00002000 08:07 326519 /usr/local/freeradius2/lib/rlm_expr-2.0.1.so b7be1000-b7beaAborted Cheers, Jørn

2 4

Radclient multihomed host
by Etienne Pretorius 30 Jan '08

30 Jan '08

Hello list, Is there anyway that I could make radclient send a packet from a diffrent src ipaddress on a multihomed host -- Kind Regards Etienne Pretorius Network Administrator Kingsley Technologies <http://www.kingsley.co.za> Email: admin(a)kingsley.co.za <mailto:admin@kingsley.co.za> Tel: 086 11 KTECH Local Fax: 086 611 5001 International Fax: +27 21 761 9930 Email Disclaimer <http://www.kingsley.co.za/index.php?id=109> Acceptable Use Policy <http://www.kingsley.co.za/index.php?id=107> www.kingsley.co.za

2 1

one RADIUS server per realm setup
by Wm. Josiah Erikson 30 Jan '08

30 Jan '08

Hello all, We are trying to set up a cross-auth proxy setup between our five RADIUS servers in different realms at five different institutions, so that any active student, staff, or faculty from any of our institutions can go to any of the other institutions and log onto the network. This means that if a user from institution B comes to my institution, I want my RADIUS server to ask the RADIUS server over at institution B instead of using the local setup. I've gotten much of it working, both authorizing and authenticating against our LDAP database here, but something about the authorization step is unclear to me. At the moment, I have it set up so that if I get a login request, it checks to see if the user is a member of the correct group(s) (authorization), and THEN authenticates the user, checking the realm to see where it should send the request for authentication. This all works very well, except that the authorization step only works if the user is one of MY users. If the user is one of the other four-college users, then the authorization step fails (since the user doesn't exists in my LDAP database) and the user is rejected. So I think I need to do one of three things: 1. Proxy authorization as well - it's not clear how to do this. Can you? I'd really just like to forward the entire request elsewhere, before anything else happens, so I'd like to check the realm FIRST, and not do anything if it's not a local realm. 2. Skip authorization entirely unless the user is a member of a specific realm. Again, it's not clear to me how to do this. Any ideas? 3. something else I haven't thought of yet. This must be something other people do too, yes? We'd like to be able to do the authorization step, because I don't want, for instance, alumns or guest users, (who are in the LDAP database) to be able to log in. I'm currently using freeradius 1.0.2, but I can upgrade if I need to. Thanks for any help, and if more info is needed, just ask! -- Wm. Josiah Erikson Computing Support School of Cognitive Science Hampshire College Amherst, MA 01002 (413) 559-6091

3 8

sql accounting - no records - 2.0.1
by Andrew Long 30 Jan '08

30 Jan '08

I've just installed 2.0.1 on CentOS 5 with MySQL 5.x. I can get the clients to authenticate and I see accounting requests come in, also I see the accounting query as it should be updated to mysql, i.e., "expand: UPDATE radacct...". I also see the accounting response returned to the client, but no accounting records are being updated in radacct table. There are no errors in debug mode relevent to mysql: rlm_sql (sql): received Acct On/Off packet expand: %{Acct-Delay-Time} -> 0 expand: UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctsessiontime = 0 AND acctstoptime = NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S' -> UPDATE radacct SET acctstoptime = '2008-01-30 07:45:06', acctsessiontime = unix_timestamp('2008-01-30 07:45:06') - unix_timestamp(acctstarttime), acctterminatecause = '', acctstopdelay = 0 WHERE acctsessiontime = 0 AND acctstoptime = NULL AND nasipaddress = '141.xxx.xxx.xxx' AND acctstarttime <= '2008-01-30 07:45:06' rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok expand: %{User-Name} -> elmaroma_cn3000 attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 33 to 141.xxx.xxx.xxx port 1025 I have tried this with 2 different clients and get the same NULL result. Authentication is fine, but any features relying on data in radacct clearly won't work, ie session-timout... I've checked the "default" config, and all accounting is set to sql. The one oddity I notice is that "default" has: # See "Accounting queries" in sql.conf sql But I can see no accounting queries anywhere in the provided sql.conf ?? Thank You. Andrew Long EWS Solutions

1 0

Re: Problems using EAP-TLS with freeradius version 2
by Stefan Puch 30 Jan '08

30 Jan '08

Stefan Puch wrote: >> Then some people came with their mobile devices which are running Windows >> Mobile 2003, Windows Mobile 5 (WM5) or Windows Mobile6 (WM6) and the >> problems began. The same EAP-TLS certificate which worked fine on a Windows >> XP machine doesn't work on e.g. Windows Mobile 6 PDA. > > You have to love Microsoft... Hmm, most of the time I'm using Linux, but 90% of the others only have a Microsoft system :-( > The EAP-TLS code was substantially re-worked in 2.0.0. It was tested with > Vista, XP SP1, XP SP2, Linux systems, MAC. It's working "live" in > environments with many, may different OS's and architectures. > > So it *should* work. I was afraid that someone says that, because I didn't believe that a new version would be released without testing. By the way, when you have tested so many different Windows systems you will have to Microsoft as well, won't you ;-) > ethereal packet traces of the RADIUS traffic would help. But I would first > suggest trying to use the test certificates that come with 2.0.1. If those > work, then the issue isn't 2.0.0 versus 1.1.7, it's that there is something > special about the certificates you're using. OK, then I will start with the provided certificates, well knowing that if then do work I will have to make new certificates for all current users... If the certificates that come with 2.0.1 also fail I will provide some ethereal packet traces. Thanks for the quick response Stefan Puch

1 0