- Freeradius-Users - lists.freeradius.org

Problems using freeradius+postgresql
by Daniel Bojczuk 29 Jun '07

29 Jun '07

Hi, I'm using Freeradius 1.1.6 with PostgreSQL 8.1. When I try to do #radtest joao senhasecreta 127.0.0.1:1812 0 testing123 Te radiusd (in debug mode) returns: #rad_recv: Access-Request packet from host 127.0.0.1:32779, id=220, length=56 # User-Name = "joao" # User-Password = "senhasecreta" # NAS-IP-Address = 255.255.255.255 # NAS-Port = 0 # Processing the authorize section of radiusd.conf #modcall: entering group authorize for request 0 # modcall[authorize]: module "preprocess" returns ok for request 0 # rlm_realm: No '@' in User-Name = "joao", looking up realm NULL # rlm_realm: No such realm "NULL" # modcall[authorize]: module "suffix" returns noop for request 0 #radius_xlat: 'joao' #rlm_sql (sql): sql_set_user escaped user --> 'joao' #radius_xlat: 'SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'joao' ??ORDER BY id' #rlm_sql (sql): Reserving sql socket id: 4 #rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'joao' ? ORDER BY id #rlm_sql_postgresql: Status: PGRES_FATAL_ERROR #rlm_sql_postgresql: affected rows = #rlm_sql_postgresql: Postgresql check_error: PGRES_FATAL_ERROR, returning SQL_DOWN #rlm_sql (sql): Attempting to connect rlm_sql_postgresql #4 #rlm_sql (sql): Connected new DB handle, #4 #rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'joao' ??ORDER BY id #rlm_sql_postgresql: Status: PGRES_FATAL_ERROR #rlm_sql_postgresql: affected rows = #rlm_sql_postgresql: Postgresql check_error: PGRES_FATAL_ERROR, returning SQL_DOWN #rlm_sql (sql): failed after re-connect #rlm_sql_getvpdata: database query error #rlm_sql (sql): SQL query error; rejecting user #rlm_sql (sql): Released sql socket id: 4 # modcall[authorize]: module "sql" returns fail for request 0 #modcall: leaving group authorize (returns fail) for request 0 #Finished request 0 When I saw the "??" int the queries i changed te query in postgresql.conf putting al the query on the same line (deleting the "/")... but it doesn't work. I'm new on using freeradius, I don't know what I can do. Thank you.. Daniel Bojczuk

2 1

Re: load balancing problem
by Hugh Messenger 29 Jun '07

29 Jun '07

"EXT / GFI REBOLJ Jean-Pierre" <ext.gfi.rebolj(a)sncf.fr> said: [snip] > ldflag = round_robin [snip] > the problem is that I see the Authentication request and response then > Accounting start on the fisrt back-end server and the accounting stop > on the second backend server. That sounds like round_robin is doing its job. >From the example proxy.conf: # If there is no ldflag attribute, or it is set to 'fail_over', then # the realms are treated as "fail-over". That is, the first matching # realm is used, unless it is down, in which case the realm "fails # over" to the second matching realm. The process continues until an # active matching realm is found, OR the DEFAULT realm is returned. # # If the ldflag attribute is set to 'round_robin', then all active # realms of the same name are put into a pool internally in the # server, and the proxied requests are evenly divided among the # realms in the pool. For this to work, all realms of the same name # MUST have the same value of their 'ldflag' attributes. Mixing up # different types of load balancing schemes for the same realm will # cause problems. If you are trying to truly load balance, rather than just failover, I don't think this can be done just in the realms config. You should probably read doc/load-balance.txt. > JPR -- hugh

1 0

load balancing problem
by EXT / GFI REBOLJ Jean-Pierre 29 Jun '07

29 Jun '07

hi, i've a proxy with freeradius 1.1.6 in load balacing with two back-end radius 1.1.6 my proxy is configured like this realm APPLI1 { type = radius authhost = xx.xx.xx.xx:1820 accthost = xx.xx.xx.xx:1821 ldflag = round_robin secret = mysecret } # Server Canna PROD Accellio GPRS de Test avec Realm realm APPLI1 { type = radius authhost = yy.yy.yy.yy:1820 accthost = yy.yy.yy.yy:1821 ldflag = round_robin secret = mysecret } I see the Authentication request and response then Accounting start an some hours later accounting stop on the proxy the problem is that I see the Authentication request and response then Accounting start on the fisrt back-end server and the accounting stop on the second backend server. is this a bug or a problem of configuration ? thanks in advance. Regards JPR

3 4

RE: [meta] admin tools and utilities
by Josh Howlett 29 Jun '07

29 Jun '07

> -----Original Message----- > From: > freeradius-users-bounces+josh.howlett=ja.net(a)lists.freeradius. > org > [mailto:freeradius-users-bounces+josh.howlett=ja.net@lists.fre eradius.org] On Behalf Of Phil Mayers > Sent: 29 June 2007 10:35 > To: FreeRadius users mailing list > Subject: Re: [meta] admin tools and utilities > > On Thu, 2007-06-28 at 12:16 -0500, Hugh Messenger wrote: > > Forgive me if meta-discussions are frowned upon. > > > > > > > > I was just wandering what tools and utilities (not shipped with > > freeradius) people find useful in day to day admin and testing. > > eapol_client from the wpa_supplicant distro was invaluable > for testing EAP I found I agree with Phil, this is an invaluable tool for testing EAP; although it's really called eapol_test :-) josh.

1 0

Wired Ethernet EAP-TLS
by Darren Maden 29 Jun '07

29 Jun '07

I'm having problems connecting a wired Ethernet machine authenticating with EAP-TLS, I'm connecting via a Lindy switch with 802.1x port authentication forced on the port that the machine is connecting to, that port is also on the same VLAN as the RADIUS server. This FreeRADIUS setup is working for wireless clients over 802.1x using EAP-TLS. My wpa_supplicant config is: ctrl_interface=/var/run/wpa_supplicant ctrl_interface_group=wheel ap_scan=0 network={ key_mgmt=IEEE8021X identity="hostname" eapol_flags=0 eap=TLS ca_cert="/etc/certs/cacert.pem" client_cert="/etc/certs/clientcert.pem" private_key="/etc/certs/clientkey.pem" private_key_passwd="password" } (Identity and Password changed for privacy) I'm initiating this with the following command: wpa_supplicant -Dwired -ieth1 -c/etc/wpa_supplicant.conf -d The RADIUS server is not receiving the request, here is an output from wpa_supplicant: State: DISCONNECTED -> ASSOCIATED Associated to a new BSS: BSSID=01:80:c2:00:00:03 No keys have been configured - skip key clearing Network configuration found for the current AP WPA: clearing AP WPA IE WPA: clearing AP RSN IE WPA: clearing own WPA/RSN IE EAPOL: External notification - portControl=Auto Associated with 01:80:c2:00:00:03 WPA: Association event - clear replay counter EAPOL: External notification - portEnabled=0 EAPOL: External notification - portValid=0 EAPOL: External notification - portEnabled=1 EAPOL: SUPP_PAE entering state CONNECTING EAPOL: SUPP_BE entering state IDLE EAP: EAP entering state INITIALIZE EAP: EAP entering state IDLE EAPOL: startWhen --> 0 EAPOL: SUPP_PAE entering state CONNECTING EAPOL: txStart EAPOL: startWhen --> 0 EAPOL: SUPP_PAE entering state CONNECTING EAPOL: txStart EAPOL: idleWhile --> 0 EAP: EAP entering state FAILURE CTRL-EVENT-EAP-FAILURE EAP authentication failed EAPOL: SUPP_PAE entering state AUTHENTICATING EAPOL: SUPP_BE entering state FAIL EAPOL: SUPP_PAE entering state HELD EAPOL: SUPP_BE entering state IDLE EAPOL: startWhen --> 0 EAPOL: heldWhile --> 0 EAPOL: SUPP_PAE entering state CONNECTING EAPOL: SUPP_PAE entering state AUTHENTICATING EAPOL: SUPP_BE entering state FAIL EAPOL: SUPP_PAE entering state HELD EAPOL: SUPP_BE entering state IDLE EAPOL: startWhen --> 0 EAPOL: heldWhile --> 0 EAPOL: SUPP_PAE entering state CONNECTING EAPOL: SUPP_PAE entering state AUTHENTICATING EAPOL: SUPP_BE entering state FAIL EAPOL: SUPP_PAE entering state HELD EAPOL: SUPP_BE entering state IDLE EAPOL: startWhen --> 0 EAPOL: heldWhile --> 0 EAPOL: SUPP_PAE entering state CONNECTING EAPOL: SUPP_PAE entering state AUTHENTICATING EAPOL: SUPP_BE entering state FAIL EAPOL: SUPP_PAE entering state HELD EAPOL: SUPP_BE entering state IDLE EAPOL: startWhen --> 0 CTRL-EVENT-TERMINATING - signal 2 received Removing interface eth1 State: ASSOCIATED -> DISCONNECTED No keys have been configured - skip key clearing EAPOL: External notification - portEnabled=0 EAPOL: SUPP_PAE entering state DISCONNECTED EAPOL: SUPP_BE entering state INITIALIZE EAP: EAP entering state DISABLED EAPOL: External notification - portValid=0 No keys have been configured - skip key clearing Cancelling scan request Is there anything special I need to do in my FreeRADIUS config? Supporting Windows wired clients is not necessary but when trying with a Windows client, it didn't work either.

4 11

[meta] admin tools and utilities
by Hugh Messenger 29 Jun '07

29 Jun '07

Forgive me if meta-discussions are frowned upon. I was just wandering what tools and utilities (not shipped with freeradius) people find useful in day to day admin and testing. My vote goes to NTRadPing, a fully featured Windows take on the standard UN*X radping. Freebie, from http://www.dialways.com/download/. Very intuitive UI for creating, saving, loading and executing auth and accounting queries. Configurable dictionary file. I'd be lost without it. Something I'd really like to find is an 'unsolicited' test service, simulating a NAS listening on 1700, to help diagnose disconnect request issues. -- hugh

3 2

Banning users in a nice way...
by Arran Cudbard-Bell 29 Jun '07

29 Jun '07

Hi, Being a nice friendly openish institution, and not wanting to overload our helpdesk staff with hundreds of users trying to set up their laptops, we decided to make registration, a self service kind of affair. We decided to setup an unauthorised VLAN, on this VLAN there exists a support server , serving support pages. On wired connections, assigning users to this VLAN is fine .. our HP Procurve switches have a lovely feature called OpenVLAN which assigns users with broken supplicant software to an arbitrary VLAN. Unfortunately there is no such solution for the wireless access points.. *sigh*.. So we currently have to reject broken supplicants, failed authentication attempts etc ... Our solution to this is not as smooth as I would like ... and that is to create a second unauthenticated, unencrypted BSSID which is attached to our unauthorised VLAN. Users connect to this BSSID, register, setup their software, then connect to the 802.1x authenticated BSSID. What we really want to be able to do, is for users with broken software, force the wireless association to succeed, and put them on the unauthorised VLAN. Of course just sending a plain old Access-Accept packet isn't sufficient, as it requires the tunneled authentication to succeed as well... Has anyone got any ideas ? I'm assuming theres no way to do it.. Oh and by broken I mean windows XP type broken, as in will only attempt TLS authentication broken... and sends the username and password a user logged into the machine with by default broken... and so can never work out of the box broken. Theres no issues with Mac Users, everything works fine there. and were assuming people running linux are clever enough to setup x supplicant without support :) -- Arran Cudbard-Bell (A.Cudbard-Bell(a)sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900

3 3

RE: Sending CA certificate during EAP-TLS
by Josh Howlett 29 Jun '07

29 Jun '07

Hi Reimer, > How do you check if FreeRadius is actually sending the chain? I find Wireshark useful for this. It re-assembles the fragmented TLS handshake, which makes it much easier to understand... josh.

1 0

Sending CA certificate during EAP-TLS
by Rafa Marin 29 Jun '07

29 Jun '07

Hi all, Is there any way to configure free radius + eap-tls module to avoid to send CA certificate during EAP-TLS negotiation? As Free Radius is sending it right now EAP-TLS packets get fragmented and I would like to avoid it. Thanks in advance.

6 8

Re : Sending CA certificate during EAP-TLS
by Eshun Benjamin 29 Jun '07

29 Jun '07

Well in my current configuration I have the RADIUS server certificate in certificate_file and CA certificate in CA_file. But with that configuration , the radius server is still sending the CA certificate. The CA_path folder is empty and the CA_file is commented out. This should work for you. tls { # # These is used to simplify later configurations. # certdir = ${raddbdir}/certs cadir = ${raddbdir}/certs/trustedCA private_key_password = whatever private_key_file = ${certdir}/server.pem certificate_file = ${certdir}/server.pem # Trusted Root CA list - CA_path folder is empty # CA_file = ${cadir}/ca.pem CA_path = ${raddbdir}/certs/trustedCA dh_file = ${certdir}/dh random_file = ${certdir}/random # fragment_size = 1024 # include_length = yes # check_crl = yes # check_cert_issuer = "/C=GB/ST=Berkshire/L=Newbury/O=My Company Ltd" # check_cert_cn = %{User-Name} # # Set this option to specify the allowed # TLS cipher suites. The format is listed # in "man 1 ciphers". cipher_list = "DEFAULT" #make_cert_command = "${certdir}/bootstrap" } ================================================== Benjamin K. Eshun ----- Message d'origine ---- De : Rafa Marín López <rafa.marinlopez(a)gmail.com> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Cc : Rafa Marin Lopez <rafa(a)dif.um.es> Envoyé le : Mercredi, 20 Juin 2007, 18h10mn 12s Objet : Re: Sending CA certificate during EAP-TLS Reimer Karlsen-Masur, DFN-CERT escribió: Hi Karlsen, thanks for the answer, please see inline... > > Argh, your misunderstanding is because of the inline > documentation/default setup of the eap config file. > > *Trusted* CAs for client auth are stored in > > CA_file > > or > > CA_path > > So there is no conflict here with certificate_file option. > > And IMO usually CA_file and certificate_file should *not* contain the > same CA certs Well in my current configuration I have the RADIUS server certificate in certificate_file and CA certificate in CA_file. But with that configuration , the radius server is still sending the CA certificate. Having said that , your proposal was to not include the CA certificate in the RADIUS server certificate (in certificate_file variable) My RADIUS server certificate does not have the CA certificate included. Even so, the RADIUS server is including the CA certificate :(... any alternative solution?. > because I guess in the majority of cases the RADIUS server cert is > issued by some (commercial) server CA where as the client certs are > mostly issued by some home grown user CA. > > Saying that there might be cases where the CA certificates from > CA_file are indeed the CA chain certs of the RADIUS server > certificate..... > > ------------------------------------------------------------------------ > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail

2 1