- Freeradius-Users - lists.freeradius.org

RE: PAM_RADIUS_AUTH - Need help
by Sobanbabu Bakthavathsalu 05 Nov '07

05 Nov '07

Hi Alan, Any thought gone on this? Why is the plugin unable to resolve the IP address of the RADIUS server, or trying to resolve an IP to IP? Is that something related to compilation? Regards Soban ________________________________________ From: Sobanbabu Bakthavathsalu Sent: 02 November 2007 11:59 To: FreeRadius users mailing list Subject: RE: PAM_RADIUS_AUTH Is this compatible with Solaris 10 First time I tried with IP address only, and got the following error. Oct 25 19:58:20 ada-delegate1 login: [ID 801593 auth.error] pam_radius_auth: Failed looking up IP address for RADIUS server 10.213.31.186 (errcode=12) Oct 25 19:58:20 ada-delegate1 login: [ID 801593 auth.error] pam_radius_auth: Failed looking up IP address for RADIUS server 10.213.69.133 (errcode=12) It was trying to resolve the IP address for an address again. Later I made a host entry and tried and the changed the config to name again. And getting the same error. Regards Soban ________________________________________ From: Sobanbabu Bakthavathsalu Sent: 31 October 2007 10:46 To: FreeRadius users mailing list Subject: RE: PAM_RADIUS_AUTH Hi Alan, First time I tried with IP address only, and got the following error. Oct 25 19:58:20 ada-delegate1 login: [ID 801593 auth.error] pam_radius_auth: Failed looking up IP address for RADIUS server 10.213.31.186 (errcode=12) Oct 25 19:58:20 ada-delegate1 login: [ID 801593 auth.error] pam_radius_auth: Failed looking up IP address for RADIUS server 10.213.69.133 (errcode=12) It was trying to resolve the IP address for an address again. Later I made a host entry and tried and the changed the config to name again. And getting the same error. Regards Soban ________________________________________ From: freeradius-users-bounces(a)lists.freeradius.org [freeradius-users-bounces(a)lists.freeradius.org] On Behalf Of Alan DeKok [aland(a)deployingradius.com] Sent: 30 October 2007 17:28 To: FreeRadius users mailing list Subject: Re: PAM_RADIUS_AUTH Sobanbabu Bakthavathsalu wrote: > Thank you for the response. There is no firewall in between the RADIUS server and Solaris server (RADIUS client), only an Cisco router with standard ACL. I have verified the ACL matches counter and found that the request from the clinet itself is not reachign the router. > Is that host entries in /etc/hosts file wont work for this, do I need a DNS server for RADIUS server name authentication to work with pam_radius_auth. No. You *can* enter just an IP address... Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html **************** CAUTION - Disclaimer ***************** This e-mail contains PRIVILEGED AND CONFIDENTIAL INFORMATION intended solely for the use of the addressee(s). If you are not the intended recipient, please notify the sender by e-mail and delete the original message. Further, you are not to copy, disclose, or distribute this e-mail or its contents to any other person and any such actions are unlawful. This e-mail may contain viruses. Infosys has taken every reasonable precaution to minimize this risk, but is not liable for any damage you may sustain as a result of any virus in this e-mail. You should carry out your own virus checks before opening the e-mail or attachment. Infosys reserves the right to monitor and review the content of all messages sent to or from this e-mail address. Messages sent to or from this e-mail address may be stored on the Infosys e-mail system. ***INFOSYS******** End of Disclaimer ********INFOSYS***

2 1

Using Freeradius with Ruby
by Werner Stucky 05 Nov '07

05 Nov '07

Hi All I want to hand off some custom processing to a ruby script. What would be the best way to implement this. I need the same functionality provided by rlm_perl. Should I use rlm_perl to call the ruby script? Or is there a better way. Thanks -- Werner Stucky Stucky Motors IT Cell : +27 72 605 0035 Fax : +27 86 636 6237 E-Mail : werner(a)stucky.co.za Web : www.stucky.co.za

2 1

FreeRadius hanging
by Phil Mayers 05 Nov '07

05 Nov '07

All, We've had sporadic problems with our Wireless radius service hanging. The occurrences tended to be spaced weeks apart, and consist of clusters of hangs 4-12 hours apart over a few days. I had formed the hypothesis that a particular client or type of client was triggering it - when they realised they could never authenticate (because unknown to them, they were hanging the server) they went away. These problems generally manifest in one of two ways: * the process hangs (and is unkillable except by -9) - most common * the process CPU runs to 100% - less common The service basically does PEAP/MS-CHAP with ntlm_auth helper and rlm_sql_postgresql; the database does not seem to be the issue. We are not HUPing the server. We were running on 1.1.6 and I was holding off reporting the issue until we had time to move to 1.1.7; however the issue has started to occur again and seems to be longer-lived this time. I've upgraded to 1.1.7 and it's still happening. I have managed to get a capture, and observe what the last packets were before the server stopped responding; sure enough, it was in the middle of a PEAP conversation. The last packet(s) the server manages to get our contain the (PEAP-fragmented) SSL server hello/certificate/hello done. The client then responds with the EAP/PEAP/TLS client key ex/change cipher/encrypted handshake, to which it never gets a response. The underlying OS is RHEL4 with OpenSSL 0.9.7a plus RHEL backports. I haven't yet managed to capture a backtrace from a hung 1.1.7 but I got a few from 1.1.6; nothing particular stands out. I'll wait until it happens again and get a definitive one from the 1.1.7 binary. Does anyone have any thoughts on what I might to do narrow the problem down?

2 1

pam_radius_auth updated spec file, please include in future releases
by Florin Andrei 05 Nov '07

05 Nov '07

I attached an updated spec file for pam_radius_auth. The original one fails when building as non-root. I fixed that and made a few other minor changes. It would be nice if the build system could generate this spec file from a template, automatically replace the version number inside the spec with the actual version of the pam_radius_auth tarball, and include the automatically generated spec in the tarball. That way, users could generate RPM packages out of the tarball by simply downloading the archive and running: rpmbuild -ta pam_radius...(version number here)...tar.gz Thanks, -- Florin Andrei http://florin.myip.org/

2 2

Maintaining a (very) dynamic user list with freeradius
by Jos Vos 05 Nov '07

05 Nov '07

Hi, What is the best way to maintain a very dynamic user list for freeradius (on a Linux platform)? I'm talking about a setup where every few minutes (sometimes every minute) a user has to be added and/or removed, with in total up to about 200 users in the user base at the same moment. Ideally, I'd like to just regenerate the users file with a script whenever a change is needed and let radiusd reload it, but I saw in the docs that reloading the config (and the users file) is "expensive", so this will probably not be very suitable for this situation. If anyhow possible I'd like to minimize any extra overhead, and avoid running PostgreSQL or MySQL servers, for example. Maybe use DBM? What is recommended for this purpose? Thanks for all suggestions. -- -- Jos Vos <jos(a)xos.nl> -- X/OS Experts in Open Systems BV | Phone: +31 20 6938364 -- Amsterdam, The Netherlands | Fax: +31 20 6948204

5 10

FreeRADIUS with PostgreSQL fails to authenticate
by Jos Vos 04 Nov '07

04 Nov '07

Hello, After configuring FreeRADIUS to use PostgreSQL, and adding a user to the database, when doing a "radtest" for that user I see with "radiusd -X": modcall[authorize]: module "sql" returns ok for request 2 modcall: group authorize returns ok for request 2 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 modcall[authenticate]: module "unix" returns notfound for request 2 modcall: group authenticate returns notfound for request 2 auth: Failed to validate the user. It looks like the password is not checked against the radcheck table. There I added the user with attribute "User-Password", op ":=" and a password value. I also added another user to the users file and that user is accepted. This is with the old freeradius 1.0.1, but I hope the problem I have is just a simple user configuration error. Thanks for any suggestions, -- -- Jos Vos <jos(a)xos.nl> -- X/OS Experts in Open Systems BV | Phone: +31 20 6938364 -- Amsterdam, The Netherlands | Fax: +31 20 6948204

2 2

Problem: Proxy cleartext-password requests to remote IAS that only
by Erling Paulsen 03 Nov '07

03 Nov '07

Hi. I have the following scenario: [1]NAS <--> [2]FreeRADIUS <--> [3]IAS [1] A NAS that supports RADIUS. It sends request-packets with "User-Password" set in cleartext. [2] A FreeRADIUS server that proxies certain users (by realm) to another server (IAS). [3] An IAS (Windows RADIUS). The problem is that this server ONLY accepts ms-chap1 or ms-chap2 session. Is there a common way to bypass this problem, I cannot find any? I was thinking it would be nice to let FreeRADIUS act as an ms-chap session client on behalf of the NAS, and then in the end only send ACCEPT/DENY back to the NAS instead of proxying directly to the IAS (which denies cleartext logins). Is this possible in some way? -- Erling Paulsen

2 1

Users can't access the Web
by Rob Borland 03 Nov '07

03 Nov '07

I've installed FreeRadius-0.9.3 (the latest version my old RedHat Linux distribution will support). FreeRadius is working fine for logins but since installing it users can't access the Web. I'd appreciate any advice. Regards, Rob

1 1

Filtering out a attribute conditionally
by Mike O'Connor 03 Nov '07

03 Nov '07

Hi All I have a problem with my Cisco 7301's where I apply a address pool via a Cisco-AVPair (for each wholesale ISP customer) and the wholesale ISP supplies a Framed-IP-Address at the same time, the connection is kicked by the cisco. Is there any way of adding or removing the ip_pool bases on a rule ? Could Freeradius 2 do this ? Thanks Mike --- Current Attrs File xxxx.com Service-Type == Framed-User, Framed-IP-Address =* 255.255.255.254, Framed-IP-Netmask == 255.255.255.255, Framed-Route =* ANY, Cisco-AVPair := "ip:addr-pool=ip_pool_netyp", Framed-Compression =* Van-Jacobson-TCP-IP, Framed-Protocol == PPP, Framed-MTU =* 1492, Framed-Filter-ID =* ANY, Cisco-AVPair =* ANY, Reply-Message =* ANY, Proxy-State =* ANY, Idle-Timeout =* 600, Session-Timeout =* 28800, Port-Limit =* 1 --- Reply with out framed-ip-address Packet-Type = Access-Accept Wed Oct 31 19:55:36 2007 Cisco-AVPair := "ip:addr-pool=ip_pool_netyp" Service-Type = Framed-User Framed-Protocol = PPP Framed-MTU = 1500 Framed-Compression = Van-Jacobson-TCP-IP Session-Timeout = 14400 Idle-Timeout = 900 Port-Limit = 1 --- Reply with framed-ip-address Packet-Type = Access-Accept Wed Oct 31 19:55:36 2007 Cisco-AVPair := "ip:addr-pool=ip_pool_netyp" Service-Type = Framed-User Framed-IP-Address = XXX.XXX.11.247 Framed-IP-Netmask = 255.255.255.255 Framed-Protocol = PPP Framed-MTU = 1500 Framed-Compression = Van-Jacobson-TCP-IP Session-Timeout = 14400 Idle-Timeout = 900 Port-Limit = 1

2 2

How to proxy password from TTLS
by Wolfgang Burger 02 Nov '07

02 Nov '07

Hi, I have a working configuration of FreeRADIUS configured for EAP-TLS. I´m trying to add support for EAP-TTLS and I want to proxy the username and password of the inner TTLS session to another Radius-Server. Client doing TTLS --> FreeRADIUS --> 3rd-Party Backend-Server with database of Users Forwarding of the packets is working. The Access-Request that FreeRADIUS sends to the backend-server uses the username entered at the client, but no password at all. If i add User-Password := "validpassword" to preproxy_users, where "validpassword" is the valid password for the given username on the Backend-Server, everything works. What do I have to change, to use the password transmitted in the TTLS-Tunnel? Or do I have fundamental errors in my idea of how to do this? Any help is very welcome. Greetings, Wolfgang Burger <burgerw(a)immunbio.mpg.de> Max-Planck-Institut fuer Immunbiologie Scientific Data Processing Unit (+00 49) 761 / 5108 461 Stuebeweg 51 D-79108 Freiburg Germany

3 7