- Freeradius-Users - lists.freeradius.org

rlm_sql bug in 64-bit architecture ?
by Richard Cotrina 24 Jul '07

24 Jul '07

Hi everyone : I've been searching for the possible causes of a problem, that appears when sqlcounter is enabled, and just in 64-bits plattforms (FreeBSD/Sparc64). The radius_xlat function performed by rlm_sql seems to not reading well some attributes like "Expiration" and always complains about "Invalid Operator", not matter what operator is put [1]. Note the big difference between the responses obtained in the 64-bit and 32-bit arch, using radtest and running radiusd in debug mode: rlm_sql can't read neither the value nor the operator for Expiration attribute, despite the fact that in both cases, the database used is the same. (rlm_sql debug options enabled in rlm_sql.c). freeradius 1.1.6 / FreeBSD Sparc64 ========================== radius_xlat: 'prueba(a)test.com' rlm_sql (sql): [snip] radius_xlat: [snip] rlm_sql: check items User-Password := "prueba" Auth-Type := Local Simultaneous-Use := 1 Max-Daily-Session := 3600 Expiration <INVALID-TOKEN> "Dec 31 1969 19:00:00 PET" <--- Notice this (where this value come from ?) rlm_sql: reply items Framed-Protocol = PPP Framed-IP-Address = 255.255.255.254 Framed-IP-Netmask = 255.255.255.255 Framed-MTU = 1500 Service-Type = Framed-User Idle-Timeout = 300 Invalid operator for item Expiration: reverting to '==' Invalid operator for item Expiration: reverting to '==' Invalid operator for item Expiration: reverting to '==' Invalid operator for item Expiration: reverting to '==' Invalid operator for item Expiration: reverting to '==' Invalid operator for item Expiration: reverting to '==' Invalid operator for item Expiration: reverting to '==' rlm_sql (sql): No matching entry in the database for request from user [prueba(a)test.com] modcall[authorize]: module "sql" returns notfound for request 9 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "dailycounter" returns noop for request 9 [snip] --> Got an Access-Reject response freeradius 1.1.6 / FreeBSD i386 ======================= radius_xlat: 'prueba(a)test.com' rlm_sql (sql): [snip] radius_xlat: [snip] rlm_sql: check items User-Password := "prueba" Auth-Type := Local Simultaneous-Use := 1 Max-Daily-Session := 3600 Expiration := "Sep 24 2007 11:30:00 PET" <--- get the correct 'op' and 'value' rlm_sql: reply items Framed-Protocol = PPP Framed-IP-Address = 255.255.255.254 Framed-IP-Netmask = 255.255.255.255 Framed-MTU = 1500 Service-Type = Framed-User Idle-Timeout = 300 modcall[authorize]: module "sql" returns ok for request 0 rlm_sqlcounter: Entering module authorize code [snip] --> Got an Access-Accept response What could be going wrong with rlm_sql ? Is there any bug in freeradius code related to 64-bit architectures ? I'd appreciate any suggestion to solve this. Richard Cotrina [1]. http://archives.free.net.ph/message/20070517.165523.c7432a23.en.html

1 0

2.0.0-pre2 Time?
by Roy Walker 23 Jul '07

23 Jul '07

Don't know if there is an official list of things needed to be done before pre2? It's been a few months, maybe time for a pre2? Roy

2 1

Different Authentication for several devices (several Nas-Ip-Address)
by nicolaskarp＠free.fr 23 Jul '07

23 Jul '07

Hello, Thank you for your help but I don't understand how you can make it. Here my configuration that I try: #Replae The Nas-Ip6address by Proxy-IP attr_rewrite overwrite_nasip { attribute = "NAS-IP-Address" searchfor = ".*" packet = packet replacewith = "10.28.65.130" max_matches = 1 } # Dev Eqpt : 192.168.48.0/24 attr_rewrite dev_equipment { attribute = "Calling-Station-Id" searchfor = ".*" packet = packet replacewith = "Dev" --> Replace String Dev for all Eqpts but not for 192.168.48.0/24!! max_matches = 1 } preproxy { files overwrite_nasip dev_equipment } Here what I want : 1. If [ NAS-IP-Address =~ 192.168.48.* ] Calling-Station-Id = Dev else if [ NAS-IP-Address =~ 192.168.49.* ] Calling-station-id = Prod else Calling-station-id = Any fi fi 2. the proxy forwards the access-request to the radius server 3. The radius server receives the acces-request If [ Nas-IP-Address == Proxy-IP and Calling-Station-Id == Dev ] instance_openldap-Ldap-Group == CiscoDev else If [ Nas-IP-Address == Proxy-IP and Calling-Station-Id = Prod ] instance_openldap-Ldap-Group == CiscoProd else instance_openldap-Ldap-Group == CiscoOthers fi fi Thank you for your assistance Nicolas.

5 9

RE: Radius server Crashing
by Chris Bell 23 Jul '07

23 Jul '07

Please see the attached... Thank you kindly! -----Original Message----- From: freeradius-users-bounces+cbell=thig.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+cbell=thig.com@lists.freeradius.org]On Behalf Of Peter Nixon Sent: Monday, July 23, 2007 1:18 PM To: FreeRadius users mailing list Subject: Re: Radius server Crashing On Mon 23 Jul 2007, Chris Bell wrote: > Hello All - > > A newbie I am so please be patient with me. I am a Junior Network Admin > who has unexpectedly inherited a Senior Admin position. Congrats. > I also inherited a problem with our Radius servers. Welcome to the list :-) > We are running freeradius-1.1.3-1.2.el5.i386. Our Network backup daemon > (Rancid) logs in to each network device on the hour to check for changes, > backup the configs, etc... > > The radius server crashes after a period of time. I think the Rancid > service is crashing it. When I log into the box running the radius > server, and check the running processes associated with radius, I get: > > radiusd 21873 1 0 05:01 ? 00:00:05 /usr/sbin/radiusd -y > radiusd 22006 21873 0 05:41 ? 00:00:00 [netstat] <defunct> > radiusd 22115 21873 0 06:40 ? 00:00:00 [netstat] <defunct> > radiusd 22417 21873 0 07:40 ? 00:00:00 [netstat] <defunct> > radiusd 22612 21873 0 08:41 ? 00:00:00 [netstat] <defunct> > radiusd 22937 21873 0 10:41 ? 00:00:00 [netstat] <defunct> > root 23300 23197 0 12:14 pts/0 00:00:00 grep rad > > The radius server(s) are running on Centos 5 if that makes a difference. > After these "defunct" processes build up to about 10 or 12... Radius no > work. Boss get mad. heh. They tend to do that on occasion... > I've searched the net and found no answers... If the answer to my problem > is painfully obvious, please remember that I started this email with a > declaration of newbness. It looks like your copy of radius is running netstat which is not exiting/being cleaned up properly. FreeRADIUS does NOT run netstat by default, so you probably have a custom module configured and it looks like it has issues. Maybe if you share your radiusd.conf we will be able to help you further... Cheers -- Peter Nixon http://peternixon.net/ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html CONFIDENTIAL NOTICE: This email including any attachments, contains confidential information belonging to the sender. It may also be privileged or otherwise protected by work product immunity or other legal rules. This information is intended only for the use of the individual or entity named above. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution or the taking of any action in reliance on the contents of this emailed information is strictly prohibited. If you have received this email in error, please immediately notify us by reply email of the error and then delete this email immediately.

2 1

2.0 mysql.sql
by Hugh Messenger 23 Jul '07

23 Jul '07

Peter - a couple of things about the MySQL stuff: 1) I just noticed that the ./docs/examples/mysql.sql schema in the 2.0 HEAD doesn't look right: # # Table structure for table 'radippool' # CREATE TABLE radippool ( id int(11) unsigned NOT NULL auto_increment, pool_name varchar(30) NOT NULL, FramedIPAddress varchar(15) NOT NULL default , NASIPAddress varchar(15) NOT NULL default , CalledStationId VARCHAR(30) NOT NULL, CallingStationID VARCHAR(30) NOT NULL, expiry_time DATETIME NOT NULL default '0000-00-00 00:00:00', username varchar(64) NOT NULL default , pool_key varchar(30) NOT NULL, PRIMARY KEY (id) ); Note the missing default values. The 1.1.7 branch has a more correct looking version. 2) Also, I just noticed in the 2.0 mysql-ippool-dialup.conf, the allocate-clear query has ... allocate-clear = "UPDATE ${ippool_table} \ SET NASIPAddress = '', pool_key = 0, \ CallingStationID = '', username = '', \ expiry_time = '0000-00-00 00:00:00' \ WHERE expiry_time <= NOW() - INTERVAL 1 SECOND AND nasipaddress = '%{Nas-IP-Address}'" Note the lower case 'nasipaddress'. Pretty please for to remember that MySQL on Windows is cASe SenSITiVe when it comes to column names. Well, by default. Yes, one can make the names case insensitive, but that can cause problems. And yeah, there aren't many of us using MySQL on Windows behind FR, but I happen to be one of them. Don't ask. :) FYI, slippool.conf in 1.1.7 has the correct case-ification. -- hugh

4 8

Radius server Crashing
by Chris Bell 23 Jul '07

23 Jul '07

Hello All - A newbie I am so please be patient with me. I am a Junior Network Admin who has unexpectedly inherited a Senior Admin position. I also inherited a problem with our Radius servers. We are running freeradius-1.1.3-1.2.el5.i386. Our Network backup daemon (Rancid) logs in to each network device on the hour to check for changes, backup the configs, etc... The radius server crashes after a period of time. I think the Rancid service is crashing it. When I log into the box running the radius server, and check the running processes associated with radius, I get: radiusd 21873 1 0 05:01 ? 00:00:05 /usr/sbin/radiusd -y radiusd 22006 21873 0 05:41 ? 00:00:00 [netstat] <defunct> radiusd 22115 21873 0 06:40 ? 00:00:00 [netstat] <defunct> radiusd 22417 21873 0 07:40 ? 00:00:00 [netstat] <defunct> radiusd 22612 21873 0 08:41 ? 00:00:00 [netstat] <defunct> radiusd 22937 21873 0 10:41 ? 00:00:00 [netstat] <defunct> root 23300 23197 0 12:14 pts/0 00:00:00 grep rad The radius server(s) are running on Centos 5 if that makes a difference. After these "defunct" processes build up to about 10 or 12... Radius no work. Boss get mad. I've searched the net and found no answers... If the answer to my problem is painfully obvious, please remember that I started this email with a declaration of newbness. Centos 5 Chris Bell Systems CONFIDENTIAL NOTICE: This email including any attachments, contains confidential information belonging to the sender. It may also be privileged or otherwise protected by work product immunity or other legal rules. This information is intended only for the use of the individual or entity named above. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution or the taking of any action in reliance on the contents of this emailed information is strictly prohibited. If you have received this email in error, please immediately notify us by reply email of the error and then delete this email immediately.

2 1

LDAP authenticiation stops working after a while
by VM 23 Jul '07

23 Jul '07

Hi everyone, I have a queer comportment on a Debian FreeRadius version The server is configured to authenticate the users (with a bind) on two identical LDAP servers through SSL. (for 802.1x authentication purposes) This works quite fine for a while (a few days) and then stops working at all untill service restart. Should this be related to a machine limitation ? A buffer overflow or so ? At the time the service stops working, about 30 LDAPS connexions are open between FreeRadius and the first LDAP server (the second one in never sollicitated) Is there a way to limit the LDAP connexions' duration and force FreeRadius to close them after this limit and open new ones (to clean its buffers) ? Any help will be appreciated. The auth mechanisms used are EAP-TTLS + PAP with SecureW2 supplicant. Best regards Vincent MAZARD DML Frane vmazard(a)dml.fr www.dml.fr ****** ATTENTION : Nouvelle adresse et nouveaux numéros de telephone ****** Vous pouvez dorénavant nous joindre ou nous écrire aux coordonnées suivantes : Tél : 01 70 56 51 51 Fax : 01 70 56 51 52 Nouvelle Adresse: 7 place Marcel Rebuffat Parc d'activités de Villejust 91971 Courtaboeuf 7 cedex

1 0

The "right" way to limit a user to one EAP Type
by Artur Hecker 23 Jul '07

23 Jul '07

Hello In the default configuration, if a User-Password is defined for a user, the user can be authenticated by all applicable authentication types. That is the sense and the beauty of the default configuration :-) However, in a practical deployment, a serious security policy is likely to state the contrary: every user (or usergroup) should be authenticated by exactly one authentication method. What is the "right" (recommended) way to do it? Could not find anything on that in Wiki. (Would be glad to add it, when finished). Background: I used to restrict users by explicitly setting for them (their group) EAP-Type := something, according to the user profile. However, as of 1.1.6, my wireless PEAP(-MSCHAPv2) user authentication does not work anymore as before: the inner PEAP authentication fails with "cannot tunnel TLS in TLS", most probably since the authorize module (sql) sets EAP-Type := PEAP. It *may* be just me though. thanks artur

3 4

Encrypt password with EAP auth
by Lubomír Vogl 23 Jul '07

23 Jul '07

Hi, I use Freeradius as authenticator for our wireless Windows XP users. I successfuly configure communication and users can authenticate (eap module). I use MySql database where I store username and params. I want to use our existing database of users but our database uses function ENCRYPT() (in MySQL) to store user password. I can't configure freeradius to use this encrypted password. Can you help me ? Lubomir Vogl

3 2

TTLS session resumption
by El hadi Iskander 23 Jul '07

23 Jul '07

Hi! I wonder if Freeradius V1.1.3-2 supports TTLS session resumption and if yes how to configure that ? Thx, E -- El hadi ISKANDER

2 1