- Freeradius-Users - lists.freeradius.org

problem in integeration with poptop
by hadi golestani 16 Oct '07

16 Oct '07

hi, I've installed poptop and freeradius well and both are working, but when I try to connect from a vpn connection or even radtest some error occured. what I need to add to users.conf for a simple radtest connection or a vpn client? it's the output of debug mode for vpn client, some thing like this has been printed for radtest also: rad_recv: Access-Request packet from host 127.0.0.1:32770, id=30, length=132 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "root" MS-CHAP-Challenge = 0x4d1a9b1028ef83957754c83ce0f55e01 MS-CHAP2-Response = 0x9e000d1394f73d58cc731cd6cf58de7cb74f00000000000000008c6daec89825fb28b90bb60b737fb683a4a80f6252935547 NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 11 modcall[authorize]: module "preprocess" returns ok for request 11 modcall[authorize]: module "chap" returns noop for request 11 rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' modcall[authorize]: module "mschap" returns ok for request 11 rlm_realm: No '@' in User-Name = "root", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 11 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 11 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 users: Matched entry DEFAULT at line 183 modcall[authorize]: module "files" returns ok for request 11 modcall: leaving group authorize (returns ok) for request 11 rad_check_password: Found Auth-Type MS-CHAP auth: type "MS-CHAP" Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 11 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for root with NT-Password radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: 4d radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '/path/to/ntlm_auth --request-nt-key --username=root --challenge=f1090a99b916ef69 --nt-response=8c6daec89825fb28b90bb60b737fb683a4a80f6252935547' Exec-Program: /path/to/ntlm_auth --request-nt-key --username=root --challenge=f1090a99b916ef69 --nt-response=8c6daec89825fb28b90bb60b737fb683a4a80f6252935547 Exec-Program output: Exec-Program: FAILED to execute /path/to/ntlm_auth: No such file or directory Exec-Program-Wait: plaintext: Exec-Program: FAILED to execute /path/to/ntlm_auth: No such file or directory Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 11 modcall: leaving group MS-CHAP (returns reject) for request 11 auth: Failed to validate the user. Delaying request 11 for 1 seconds Finished request 11 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 30 to 127.0.0.1 port 32770 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 11 ID 30 with timestamp 47152198 Nothing to do. Sleeping until we see a request.

2 3

rlm_passwd pulling file?
by Joe Mom 16 Oct '07

16 Oct '07

looking for some sort of indication that the radius.conf file is working. I've created a section in the radius.conf file under modules as per man rlm_passwd passwd tcovc_group { filename = /home/ftpuser/export.txt format = "*User-Name:LM-Password" delimiter = ":" } but either my hash is not working properly or its not pulling the user:passwords from the file. I checked in the startup.log file after doing a HUP and i dont see any indication that it pulled the data from the file. I also did a reboot of the system to be doubly sure. is there a spot that i can eliminate the possibility of the file not being pulled in or just me :) -- Regards Joe

1 0

encrypted password LDAP and EAP//TTLS
by Sergio Belkin 16 Oct '07

16 Oct '07

Hi, is it possible use in LDAP encrypted passwords and EAP/TTLS? Thanks in advance! -- -- Sergio Belkin -

3 5

802.1x & kerberos
by Lisa Besko 16 Oct '07

16 Oct '07

Is there a way to do 802.1x with Kerberos authentication using Freeradius? If their is can anyone point me in the right direction? We have been trying eap-ttls most recently with very little luck but everything I have read says this should be possible. What are we missing? Thanks, LB

6 11

rlm_perl (threads) performance question
by Apostolos Pantsiopoulos 16 Oct '07

16 Oct '07

I am using the rlm_perl module for accounting purposes. I tried to benchmark the whole process by doing something like this : sub accounting{ start_benchmark(); // acct start code here stop_benchmark(); send_bench_results_using_udp(); } sub stop_accounting{ start_benchmark(); // acct stop code here stop_benchmark(); send_bench_results_using_udp(); } I hope that the routines names I used are self-explanatory. In my config I have 32 servers running, using 32 perl clones. The results I get (after 2-3 k requests) are these : Mean time for acct start : 0.005 secs Mean time for acct stop : 0.01 secs Since there is a 1:1 ratio of start/stop requests I guess that we can say that for each request (regardless of its type) I should get a mean of 0.0075 secs. And this in turn should be giving about 130 req/sec. But I am not getting this kind of performance. I know that there is a handling overhead for each request. I don't know the exact percentage of this overhead but for simplicity's sake lets be pessimistic and consider it to be about 30%. Now the performance should be something like 80 req/sec. But I am not getting this kind of performance either. In fact, as soon as my main radius reaches a number of 50 req/sec my NAS starts sending requests to my backup radius. Correct me if I am wrong : If every perl clone can complete each request in X secs shouldn't 32 clones complete 1/X*32 requests per second? Or something similar to that? (even half of that would be great, considering the extra overhead for handling these threads) I used the debug output when my server served about 30-40 requests/sec and I noticed this "perl_pool total/active/spare [32/0/32]" With a utilisation such as that (30-40 req/secs) shouldn't more perl clones be active (unless the above line means something else). The problem does not seem to be the database. I made a simple program that uses the exact same code as my radius perl script does and I can get this kind of performance easily. So what I am trying to say here is that I get this "feeling" that I do not get any concurrency at all from my radius daemons. I checked my Perl installation an both threads and multiplicity is enabled : usethreads=define use5005threads=undef useithreads=define usemultiplicity=define Any help would be appreciated. -- ------------------------------------------- Apostolos Pantsiopoulos Kinetix Tele.com Support Center email: apant(a)kinetix.gr, support(a)kinetix.gr Tel. & Fax: +30 2310556134 Mobile : +30 6937069097 MSN : apant2(a)hotmail.com WWW: http://www.kinetix.gr/ -------------------------------------------

3 2

Compile errors
by Dánial Olsen 16 Oct '07

16 Oct '07

I'm getting these errors when compiling CVS and 2.0.0-pre2 on OpenBSD 4.1: Making all in lib... gmake[3]: Entering directory `/root/freeradius/freeradius-server-2.0.0-pre2/src/lib' /root/freeradius/freeradius-server-2.0.0-pre2/libtool --mode=compile gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -D_LIBRADIUS -I/root/freeradius/freeradius-server-2.0.0-pre2/src -c dict.c mkdir .libs gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -D_LIBRADIUS -I/root/freeradius/freeradius-server-2.0.0-pre2/src -c dict.c -fPIC -DPIC -o .libs/dict.o In file included from /root/freeradius/freeradius-server-2.0.0-pre2/src/freeradius-devel/libradius.h:30, from dict.c:26: /root/freeradius/freeradius-server-2.0.0-pre2/src/freeradius-devel/missing.h:182: error: redefinition of `struct in6_addr' In file included from /root/freeradius/freeradius-server-2.0.0-pre2/src/freeradius-devel/libradius.h:30, from dict.c:26: /root/freeradius/freeradius-server-2.0.0-pre2/src/freeradius-devel/missing.h:188:1: warning: "s6_addr" redefined In file included from /usr/include/netinet/in.h:554, from /root/freeradius/freeradius-server-2.0.0-pre2/src/freeradius-devel/missing.h:42, from /root/freeradius/freeradius-server-2.0.0-pre2/src/freeradius-devel/libradius.h:30, from dict.c:26: /usr/include/netinet6/in6.h:124:1: warning: this is the location of the previous definition /root/freeradius/freeradius-server-2.0.0-pre2/src/freeradius-devel/missing.h:272: error: redefinition of `struct sockaddr_storage' In file included from dict.c:31: /usr/include/malloc.h:4:2: warning: #warning "<malloc.h> is obsolete, use <stdlib.h>" gmake[3]: *** [dict.lo] Error 1 gmake[3]: Leaving directory `/root/freeradius/freeradius-server-2.0.0-pre2/src/lib' gmake[2]: *** [common] Error 2 gmake[2]: Leaving directory `/root/freeradius/freeradius-server-2.0.0-pre2/src' gmake[1]: *** [all] Error 2 gmake[1]: Leaving directory `/root/freeradius/freeradius-server-2.0.0-pre2/src' gmake: *** [common] Error 2 *** Error code 2 Stop in /root/freeradius/freeradius-server-2.0.0-pre2 (line 18 of Makefile). Any clues? /Danial

2 1

Freeradius Clustering
by Fred Zinsli 16 Oct '07

16 Oct '07

Hello everyone Sorry if this has been covered, but I have googled without finding. I am looking to replace our current servers and am looking to reconfigure the network. I am wanting to know if Freeradius can be clustered? and if so can someone point me to some documentation on the subject. I am also wanting to know how the calculate the new specs for the new servers. Many thanks in advance. Regards Fred

4 3

FATAL: Thread create failed: Cannot allocate memory
by Phil Mayers 15 Oct '07

15 Oct '07

We had one of our MAC-auth radius server instances hang up with this error at about 0200 this morning. That server receives pretty heavy load, and it's bursty, so we see this a couple of times a day: The maximum number of threads (32) are active, cannot spawn new thread to handle request ...but it does not cause problems. An inability to create a new thread is an entirely different matter though; it implies <max threads are running, the server tried to create a new one, and the OS couldn't allocate a thread. Any ideas how to resolve this? Version is FreeRadius 1.1.6 (only reason we haven't upgraded is change control, it's due shortly)

3 3

Re: Using freeradius and 802.1x for dynamic VLAN
by lvizcardof＠unsa.edu.pe 15 Oct '07

15 Oct '07

Hi, >> carlos Auth-Type = EAP, User-Password == "carlos" > ^^^^^^^^^^^^^^^^ I remove the parte indicated carlos User-Password == "carlos" The problem continue i did thefollowing: In my swich I form three vlan 2,3,4 After I signed ip to the vlans and ports too. This is all the configuration from the switch: =========================== console# show running-config interface ethernet g1 exit vlan database vlan 2-4 exit interface range ethernet g(2-8) switchport access vlan 2 exit interface range ethernet g(9-14) switchport access vlan 3 exit interface range ethernet g(15-20) switchport access vlan 4 exit dot1x system-auth-control interface range ethernet g(2-8,10-14,16-20) dot1x port-control auto exit interface range ethernet g(2-8,10-14,16-20) dot1x re-authentication exit interface vlan 2 ip address 192.168.2.2 255.255.255.0 exit interface vlan 3 ip address 192.168.3.3 255.255.255.0 exit interface vlan 4 ip address 10.20.10.251 255.255.255.0 exit ip default-gateway 10.20.10.1 radius-server host 10.20.10.13 auth-port 1645 timeout 3 radius-server host 10.20.10.251 auth-port 1645 timeout 3 retransmit 3 key mi secreto radius-server host 192.168.2.2 auth-port 1645 timeout 3 retransmit 3 key mis ecreto radius-server host 192.168.3.3 auth-port 1645 timeout 3 retransmit 3 key mis ecreto radius-server key misecreto aaa authentication dot1x default radius username admin password 7d8c9c8b116cdfe3fb091f4c1ac684de level 15 encrypted Vlan Name Ports Type Authorization ---- ----------------- --------------------------- ------------ ------------- 1 1 g(1,21-24),ch(1-8) other Required 2 2 g(1-8) permanent Required 3 3 g(1,9-14) permanent Required 4 4 g(15-20) permanent Required console# show ip interface Gateway IP Address Activity status Type ----------------------- ----------------------- -------- 10.20.10.1 Active static IP Address I/F Type ----------------------- ---------------------- --------- 10.20.10.251/24 vlan 4 Static 192.168.2.2/24 vlan 2 Static 192.168.3.3/24 vlan 3 Static =============================================== How you see this is the configuration from my switch. In the file users I have the following configuration. +++++++++++++++++++++++++++++++++++++++++++++ carlos User-Password == "carlos" Service-Type = Framed-User, Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 2 saul User-Password == "saul" Service-Type = Framed-User, Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID = 4 +++++++++++++++++++++++++++++++++++++++++++++ Now the problem is that: The PC client (WindowsXP) is connected to the port 17 for that it is included in the vlan 4. When I intro the user: carlos and his password: carlos it shouldn't autenticate becauses it user is asigned to the vlan 2. But the problem is that the user is autenticate and has access to the vlan4. My conclution is that: Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 2 don work. I probably need to configure something. ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program.

3 2

userfile username:password
by Joe Mom 15 Oct '07

15 Oct '07

Sorry its been a while since i've setup a freeradius server. I'm using Freeradius 1.1.6 on gentoo, I remember there being a way to drop in a user list in the format of "username:password" exported from another server, but cant for the life of me, remember what or how to do it. I've scoured the google and what not, but without a name of a module or method i'm just spinning my tires at this point. any help at all will be greatly appreciated. -- Regards Joe

2 1