- Freeradius-Users - lists.freeradius.org

(no subject)
by Defryn, Guy 16 Sep '07

16 Sep '07

Hi, I am new to freeradius and I just had to upgrade one of our servers to RHEL5. As part of this deployment, I have installed freeradius-1.1.3-1.2 and openldap-2.3.27-5. I have looked on the web and talked to some colleagues and this is probably and openldap issue. I am sure it has popped up on this discussion list before. radius is taking up 95% of the CPU. I seem to be getting errors that says that all ldap connections are in use (rlm_ldap) Fri Sep 14 15:39:48 2007 : Error: WARNING: Unresponsive child (id 2992090000) for request 46 Fri Sep 14 15:39:48 2007 : Error: WARNING: Unresponsive child (id 2981600144) for request 47 Fri Sep 14 15:39:48 2007 : Error: WARNING: Unresponsive child (id 2971110288) for request 48 Fri Sep 14 15:39:48 2007 : Error: rlm_ldap: All ldap connections are in use We did not have any issue with version 2.29 of OpenLdap. Has something major changed? We are gonna downgrade for the time being but if you know of a solution please let me know. cheers

1 0

FreeRADIUS 2.0.0-pre2 has been released
by Alan T DeKok 16 Sep '07

16 Sep '07

After much waiting, 2.0.0-pre2 has been released. It contains MAJOR functionality upgrades from 2.0.0-pre1. The new "unlang" feature can be used to easily implement most policies. The virtual server support makes running complicated configurations much easier than before. For full details, see: http://freeradius.org/press/index.html#freeradius-2.0.0-pre2 Please download it and test it. The current pre-release looks to be very close to what will become a final 2.0.0. Alan DeKok.

7 15

intermediate CA authentication failing
by mallika 16 Sep '07

16 Sep '07

I am using freeradius 1.0.2. By using the openssl i created selfsigned root certificate and from that i created intermediate ca certificate.By using the intermediate CA i created user certificate.When in 802.1x wired EAP-TLS authentication , from the client side i was providing the certificate certified by the intermediate CA.I copied rootCA and Intermediate CA to /etc/raddb/certs.in that case it is not checking for certificate chain deapth. IT is giving error 22 and unknown CA.please can any body help me . -- View this message in context: http://www.nabble.com/intermediate-CA-authentication-failing-tf4433620.html… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 8

Re: Configuring FreeRADIUS to use ntlm_auth
by charles＠copel.com 16 Sep '07

16 Sep '07

Alan: > Now I am trying to "Configuring my FreeRadius to use ntlm_auth for > MS-CHAP" to authenticate my NT users, ok ? The page does document that. ==> I am trying to following this document. > After that I configure the radiusd.conf file with the necessary changes > (about ntlm_auth), I am trying to test the authenticate with a valid > user of my NT Domain (by radtest) and the FreeRadius reject it. radtest doesn't do MS-CHAP. The page tries to make this clear. ==> Sorry ... but I hadn´t understood it (I thought that just radclient doesn´t work). Now I know that radtest too ... > The output of my FreeRadius´s console: ... > rad_check_password: Found Auth-Type System You've done rather a lot more than just add "ntlm_auth" to the "authenticate" section. This means that the config that previously worked... now doesn't work. ==> I think this configuration is original (FreeRadius instalation´s). Because, in the previous test this configuration was already there. And the previous test works (Configuring FreeRADIUS to use ntlm_auth)! Go back to using the working configuration, and use a client that does MS-CHAP. This usually means trying a real login, without using "radtest" or "radclient". ==> I tried to use the working configuration with a real login, but the behavior is the same, it appears the message that you mencioned: "rad_check_password: Found Auth-Type System" Can you help me ? Best Regards, Charles.

3 2

automated response
by Olaf Becker 15 Sep '07

15 Sep '07

I will be out of the office starting 09/15/2007 and will not return until 09/26/2007. In the meantime you can reaching Michael Goerlich mgoerlich(a)trustinternational.com or Dave Chladek dchladek(a)trustinternational.com or if it is any network related stuff you can reach Christoph Ziemann cziemann(a)trustinternational.com . I have only limited access to my Email and try respond as soon I am back in the office. regarding Olaf Becker

1 0

Touble configuring SQL data store for users
by Bill Shaver 15 Sep '07

15 Sep '07

I have started to experiment with using mysql as the datastore for users and clients instead of the default file method for my relatively small installation. Right now my work is on a test system and all is working well, with one exception: a user that is a member of two or more groups. Based on all I have read, this last thing should be very basic. If I put the user in only groupA (in the usergroup table), the test works great. If I put user1 in only groupB, the test works great. When I put user1 in both groupA and groupB in the usergroup table it will only work against the first record of the two, the second record always returns a failure. I am sure this is probably something really stupid, but I just cannot see it. Any help would be appreciated. I have attatched table dumps, sample commands, and a debug trace. I hope it is helpful Thanks, --Bill FreeRadius version 1.0.1 MySQL version 4.1.20 vm # /usr/bin/radtest -d /etc/raddb kparr@cisi password \ localhost:1645 10 naspass will sucseed, while vm # /usr/bin/radtest -d /etc/raddb kparr@syst password \ localhost:1645 10 naspass fails, but should sucseed The following is a test data set to validate a variety of cases that we need to support in our environment. select * from radcheck into outfile '/tmp/f1'; -------------------------------------------------------- id username attribute op value -- -------- --------- -- ----- 1 bill Password == userpass 5 guest01 Auth-Type := Local 6 guest01 Password == password select * from radreply into outfile '/tmp/f4'; -------------------------------------------------------- id username attribute op value -- -------- --------- -- ----- 7 guest01 Class := OU=Wireless; 8 guest01 Fall-Through := No select * from radgroupcheck into outfile '/tmp/f2'; -------------------------------------------------------- id groupname attribute op value -- -------- --------- -- ----- 6 LocalUnix Auth-Type == System 7 LocalUnix Realm == Test 9 LdapCiscoAdm Password == password 10 LdapCiscoAdm Auth-Type == Local 11 LdapCiscoAdm Realm == cisi 12 LdapHpReho Realm == syst 13 LdapHpReho Auth-Type == Local 14 LdapHpReho Password == password 15 Rejected Auth-Type := Reject select * from radgroupreply into outfile '/tmp/f3'; -------------------------------------------------------- id groupname attribute op value -- -------- --------- -- ----- 8 LocalUnix Service-Type = Login 0 9 LdapCiscoAdm Cisco-AVPair = shell:priv-lvl=15 0 10 LdapCiscoAdm Class := OU=cis; 0 11 LdapCiscoAdm Fall-Through := Yes 0 12 LdapCiscoAdm Service-Type = 6 0 13 LdapHpReho Class := OU=Proj; 0 14 LdapHpReho Fall-Through := Yes 0 15 Rejected Fall-Through := No 0 17 Rejected Reply-Message := Account is locked out. 0 select * from usergroup into outfile '/tmp/f5'; -------------------------------------------------------- id username groupname -- -------- --------- 9 root LocalUnix 10 kparr LdapCiscoAdm 11 kchow LdapHpReho 12 jpage Rejected 13 kparr LdapHpReho 14 bshaver LdapCiscoAdm -------------------------------------------------------- vm # radiusd -x Starting - reading configuration files ... Module: Loaded exec Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded System Module: Instantiated unix (unix) Module: Loaded eap rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap rlm_eap: Loaded and initialized type gtc rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess Module: Instantiated preprocess (preprocess) Module: Loaded realm Module: Instantiated realm (suffix) Module: Loaded files Module: Instantiated files (files) Module: Loaded SQL rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to root@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id Module: Instantiated acct_unique (acct_unique) Module: Loaded detail Module: Instantiated detail (detail) Module: Loaded radutmp Module: Instantiated radutmp (radutmp) Initializing the thread pool... Listening on authentication *:1645 Listening on accounting *:1646 Listening on proxy *:1647 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32773, id=23, length=62 User-Name = "kparr@cisi" User-Password = "password" NAS-IP-Address = 255.255.255.255 NAS-Port = 10 rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): User kparr not found in radcheck rlm_sql (sql): Released sql socket id: 4 Sending Access-Accept of id 23 to 127.0.0.1:32773 Cisco-AVPair = "shell:priv-lvl=15" Class := 0x4f553d6369733b Service-Type = Administrative-User rad_recv: Access-Request packet from host 127.0.0.1:32773, id=27, length=62 User-Name = "kparr@syst" User-Password = "password" NAS-IP-Address = 255.255.255.255 NAS-Port = 10 rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): User kparr not found in radcheck rlm_sql (sql): No matching entry in the database for request from user [kparr] rlm_sql (sql): Released sql socket id: 3 rad_recv: Access-Request packet from host 127.0.0.1:32773, id=27, length=62 Sending Access-Reject of id 27 to 127.0.0.1:32773

1 0

Gigawords
by Guilherme Franco 14 Sep '07

14 Sep '07

Hello, I'm using rlm_sql_log in freeradius 1.1.4. In order to correctly work with acct-input/ output gigawords, I've replaced '%{Acct-Input-Octets}' with '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}' in the rlm_sql_log conf, but this results in invalid queries like: "update radacct set... ...acctiputoctets = 0 << 32 | 98..." Looks like the rlm_sql_log module was not compiled to parse that sintax. What can I do, please (besides create a procedure on the DB to treat that)? Thank you very much. Guilherme Franco

3 4

set up freeradius to use /etc/passwd and separate authorization account
by Vinh T. Nguyen 14 Sep '07

14 Sep '07

Hi, I would like to set up around 100 user profiles. Each user profile has its own Cisco permit statement to allow the user to access specific hosts. The authentication method will be checked against /etc/passwd file. Could someone please show me how to accomplish this. How to force users to check against system /etc/passwd and how to create each separate profile to return to NAS? Thanks in advance for your reply. I am currently using freeradius1.1.7 on Linux Enterprise. Regards, Vinh --------------------------------- Be a better Heartthrob. Get better relationship answers from someone who knows. Yahoo! Answers - Check it out.

1 0

unlang question
by Norbert Wegener 14 Sep '07

14 Sep '07

I want to use the result from a sql query in something like this: ... switch "%{sqlnastype:SELECT nas.type FROM `nas` WHERE nas.nasname ='%{NAS-IP-Address}'}" { case "Cisco" { ... It works, and it is a great feature. The point is, it seems to work only if there is an authorize_check_query and a authorize_reply_query in the sql module. So I have to setup an authorize_reply_query with UserName,Attr Nam, Attr Value, Op, although I am only interested in the answer to the query above, which might be Cisco, Entrasys or something like that. Is there a way to avoid such an authorize_reply_query or even the authorize_check_query? Norbert Wegener

2 1

Check for Certificate AND Username
by Wolfgang Burger 14 Sep '07

14 Sep '07

Hi, I am using freeradius to secure my WLAN. Everything works fine so far. But i`m not much of an expert. What I have now is a working setup using EAP/TLS and self-created certificates. But how can i achieve the following: - Client sends certificate and Username/Password (done) - freeradius checks for valid certificate (done) - freeradius ADDITIONALLY checks Username/Password with another Radius-Server. I guess I have to use the proxy settings. But how do i make freeradius check BOTH conditions? Any help would be appreciated Regards, Wolfgang Burger

2 3