- Freeradius-Users - lists.freeradius.org

re： Problem on freeradius+openldap+tls
by Hangjun He 25 Jun '07

25 Jun '07

freeradius version 1.1.6 openldap version 2.3.23 opensll verson 0.9.7g Hangjun He <elmerhe(a)yahoo.com.cn> 写道： hi, freeradis with openldap is OK when use cleartext communication. Now I want to use tls. openssl s_client -connect 127.0.0.1:636 -showcerts -state -CAfile /usr/local/etc/openldap/ssl/cacert.pem show the cacert /cert/key is correct. But when I use freeradis with tls, errors pup up: freeradius error: rlm_ldap: - authorize rlm_ldap: performing user authorization for hwang radius_xlat: '(uid=hwang)' radius_xlat: 'ou=People,dc=aerohive,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 127.0.0.1:389, authentication 0 rlm_ldap: setting TLS CACert File to /usr/local/etc/openldap/ssl/cacert.pem rlm_ldap: setting TLS Require Cert to demand rlm_ldap: starting TLS rlm_ldap: ldap_start_tls_s() rlm_ldap: could not start TLS Connect error rlm_ldap: (re)connection attempt failed rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 openldap error: TLS trace: SSL_accept:SSLv3 read client hello A TLS trace: SSL_accept:SSLv3 write server hello A TLS trace: SSL_accept:SSLv3 write certificate A TLS trace: SSL_accept:SSLv3 write server done A tls_write: want=902, written=902 ...... TLS trace: SSL_accept:SSLv3 flush data tls_read: want=5, got=5 0000: 15 03 01 00 02 ..... tls_read: want=2, got=2 0000: 02 2a .* TLS trace: SSL3 alert read:fatal:bad certificate TLS trace: SSL_accept:failed in SSLv3 read client certificate A TLS: can't accept. TLS: error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate s3_pkt.c:1052 connection_read(11): TLS accept failure error=-1 id=5, closing connection_closing: readying conn=5 sd=11 for close connection_close: conn=5 sd=11 daemon: removing 11 When I use freeradius in the same host with openldap, There are other errors: connection_get(10) connection_get(10): got connid=11 connection_read(10): checking for input on id=11 TLS trace: SSL_accept:before/accept initialization TLS trace: SSL_accept:SSLv3 read client hello A TLS trace: SSL_accept:SSLv3 write server hello A TLS trace: SSL_accept:SSLv3 write certificate A TLS trace: SSL_accept:SSLv3 write certificate request A TLS trace: SSL_accept:SSLv3 flush data TLS trace: SSL_accept:error in SSLv3 read client certificate A TLS trace: SSL_accept:error in SSLv3 read client certificate A connection_get(10) connection_get(10): got connid=11 connection_read(10): checking for input on id=11 TLS trace: SSL_accept:SSLv3 read client certificate A TLS trace: SSL_accept:SSLv3 read client key exchange A TLS trace: SSL_accept:SSLv3 read finished A TLS trace: SSL_accept:SSLv3 write change cipher spec A TLS trace: SSL_accept:SSLv3 write finished A TLS trace: SSL_accept:SSLv3 flush data connection_read(10): unable to get TLS client DN, error=49 id=11 connection_get(10) connection_get(10): got connid=11 connection_read(10): checking for input on id=11 ber_get_next ber_get_next: tag 0x30 len 5 contents: ber_get_next TLS trace: SSL3 alert read:warning:close notify partly configuration in slapd.conf: TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSCACertificateFile /usr/local/etc/openldap/ssl/cacert.pem TLSCertificateFile /usr/local/etc/openldap/ssl/servercrt.pem TLSCertificateKeyFile /usr/local/etc/openldap/ssl/serverkey.pem TLSVerifyClient try Can anyone tell me why it is? Anything wrong with my configure file. Thanks! John --------------------------------- 抢注雅虎免费邮箱3.5G容量，20M附件！ --------------------------------- 抢注雅虎免费邮箱-3.5G容量，20M附件！

2 2

users authentication failed
by Carl aniams 25 Jun '07

25 Jun '07

hi i am using freeradius 1.1.6 with mysql 4 on a fedora core 4 with a DD-WRT v23 with enabled chilli. i have the users created through the dialupadmin page. users are successfully created but while trying to log through chilli i have the following when i do radiusd -X please any suggestion welcome Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.3:2051, id=0, length=197 User-Name = "akim" User-Password = "\332%\300D\310\373h\345]\237\036\216\242\373\362\001" NAS-IP-Address = 0.0.0.0 Service-Type = Login-User Framed-IP-Address = 192.168.182.2 Calling-Station-Id = "00-90-4B-A4-D0-E8" Called-Station-Id = "00-18-F8-68-09-F5" NAS-Identifier = "hotspot" Acct-Session-Id = "467fca8f00000000" NAS-Port-Type = Wireless-802.11 NAS-Port = 0 Message-Authenticator = 0x23a39f4c2fabd6436787a53362759cf8 WISPr-Logoff-URL = "http://192.168.182.1:3990/logoff" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "akim", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'akim' rlm_sql (sql): sql_set_user escaped user --> 'akim' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'akim' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName, radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'akim' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'akim' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName, radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'akim' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_unix: [akim]: invalid password modcall[authenticate]: module "unix" returns reject for request 0 modcall: leaving group authenticate (returns reject) for request 0 auth: Failed to validate the user. WARNING: Unprintable characters in the password. ? Double-check the shared secret on the server and the NAS! Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 0 to 192.168.1.3 port 2051 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 467fb396 Nothing to do. Sleeping until we see a request. -- -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_ ANIAMBOSSOU Carl NIAMS TECHNOLOGIES tel: +229 90 04 08 58 +229 97 48 01 33 COTONOU REPUBLIC OF BENIN WEST AFRICA

3 2

reference guide...
by suganthi V 25 Jun '07

25 Jun '07

Hi all, I am new to freeradius. I want to understand the over all code flow and design of freeradius. Can anyone suggest any reference guide for understanding the design of freeradius please??????? I went thro some manuals of freeradius. But they r theoritical, explaining about radius configurations and packet formats. But i want to understand the design of that... Please help me if u know some guide..... Thanks a lot..... --------------------------------- Heres a new way to find what you're looking for - Yahoo! Answers

2 3

RE: terminating EAP tunnels, proxy and realms
by Josh Howlett 25 Jun '07

25 Jun '07

> > Nope; see RFC 3579 for the gory details: > > > > "the NAS MUST copy the contents of the Type-Data field of the > > EAP-Response/Identity received from the peer into the User-Name > > attribute" > > > > See thats what I suspected, else how could the User-Name > attribute be populated in the access requests... > And indeed as the RFC states, the User-Identity needs to be > set in the access requests for none EAP aware proxies. I > suspect FreeRADIUS may count as one of these, as for all > intensive purposes as it provides no mechanism to proxy > arbitrary segments of an EAP conversation on inner identity alone. > Unless I missed something ? No, that's correct. > > For the reason given above, it *does* need to understand the > > EAP-Identity-Response. But that's about it! The NAS is a > pretty dumb > > device. > > Reason why I was asking is because most of the tests on the > JRS test website seem to break when you base the reply in > FreeRADIUS, on the inner identity as opposed to the outer identity. I'm surprised at that, IIRC (and I did write the code originally :-) the tests use the same name for inner and outer. Still, it would probably be best if you raised a ticket with JANET Customer Services as this is a bit OT for this list. best regards, josh.

1 0

cvs.freeradius.org failure?
by Milan Holub 25 Jun '07

25 Jun '07

Hi Alan, is it possible that something is wrong with freeradius cvs? I can't log in as anoncvs nor I can do diffs or whatever. Client just hangs - eg.: `cvs -d:pserver:anoncvs@cvs.freeradius.org:/source login` Logging in to :pserver:anoncvs@cvs.freeradius.org:2401/source CVS password: ==> nothing happens for a long time cvs [login aborted]: received interrupt signal ==> killed by ctrl-c Please advise. With regards. Milan Holub holub (at) thenet (dot) ch -------------------------------------- TheNet-Internet Services AG, im Bernertechnopark, Morgenstr. 129 CH-3018, Bern, Switzerland 031 998 4333, Fax 031 998 4330 http://www.thenet.ch http://wlan.thenet.ch --------------------------------------

2 2

radiusd stop responding. deadlock?
by blue_11j＠yahoo.co.jp 25 Jun '07

25 Jun '07

Hi, I'm *sorry* that I am not good at English because I'm Japanese. We using freeradius 1.1.0 for PEAP authentication, and it is working well almost. but sometime, radiusd stops responding.CPU usage is 100%. (need to radiusd stop/start). following is result of ps. -------------------------------- #ps -efml | grep radius 1 S root 10134 10127 0 69 0 - 7395 148a46 Jun19 ? 00:00:00 /usr/dot1x/sbin/radiusd -d /e tc/raddb -l syslog -g local0 -x 1 S root 17737 10134 0 69 0 - 7395 10800b Jun19 ? 00:00:01 /usr/dot1x/sbin/radiusd -d /e tc/raddb -l syslog -g local0 -x 1 S root 17835 10134 0 68 0 - 7395 10800b Jun19 ? 00:00:00 /usr/dot1x/sbin/radiusd -d /e tc/raddb -l syslog -g local0 -x 0 R root 10127 1 47 80 0 - 7395 - Jun19 ? 19:24:13 /usr/dot1x/sbin/radiusd -d /e tc/raddb -l syslog -g local0 -x 1 S root 17769 10134 0 69 0 - 7395 10800b Jun19 ? 00:00:01 /usr/dot1x/sbin/radiusd -d /e tc/raddb -l syslog -g local0 -x 1 R root 17800 10134 49 76 0 - 7395 - Jun19 ? 19:19:02 /usr/dot1x/sbin/radiusd -d /e tc/raddb -l syslog -g local0 -x 1 S root 17713 10134 0 69 0 - 7395 10800b Jun19 ? 00:00:01 /usr/dot1x/sbin/radiusd -d /e tc/raddb -l syslog -g local0 -x -------------------------------- pid:10127(main) eats 47% CPU. pid:17800 eats 49% CPU. following is result of gdb about these thread. -------------------------------- # gdb GNU gdb 5.3 Copyright 2002 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-slackware-linux". (gdb) attach 10127 Attaching to process 10127 Reading symbols from /usr/dot1x/sbin/radiusd...(no debugging symbols found)... done. ....(snip)... 0x4019a072 in pthread_once () from /lib/libpthread.so.0 (gdb) where #0 0x4019a072 in pthread_once () from /lib/libpthread.so.0 #1 0x4027df03 in malloc () from /lib/libc.so.6 #2 0x401eae87 in rad_recv () from /usr/dot1x/lib/libradius-1.1.0.so #3 0x0804d78b in main () #4 0x4021cd06 in __libc_start_main () from /lib/libc.so.6 (gdb) detach Detaching from program: /usr/dot1x/sbin/radiusd, process 10127 (gdb) (gdb) (gdb) attach 10127 Attaching to program: /usr/dot1x/sbin/radiusd, process 10127 Symbols already loaded for /lib/libcrypt.so.1 ....(snip)... 0x401998cc in pthread_mutex_trylock () from /lib/libpthread.so.0 (gdb) whrere #0 0x401998cc in pthread_mutex_trylock () from /lib/libpthread.so.0 #1 0x4027c65f in _IO_file_xsputn () from /lib/libc.so.6 #2 0x4027df03 in malloc () from /lib/libc.so.6 #3 0x401eae87 in rad_recv () from /usr/dot1x/lib/libradius-1.1.0.so #4 0x0804d78b in main () #5 0x4021cd06 in __libc_start_main () from /lib/libc.so.6 (gdb) detach Detaching from program: /usr/dot1x/sbin/radiusd, process 10127 (gdb) (gdb) attach 17800 Attaching to program: /usr/dot1x/sbin/radiusd, process 17800 Symbols already loaded for /lib/libcrypt.so.1 ....(snip)... 0x4027f4b0 in mallopt () from /lib/libc.so.6 (gdb) (gdb) where #0 0x4027f4b0 in mallopt () from /lib/libc.so.6 #1 0x4027ed83 in mallopt () from /lib/libc.so.6 #2 0x4027df1a in malloc () from /lib/libc.so.6 #3 0x4038a2e9 in ber_memalloc_x () from /usr/dot1x/lib/liblber-2.2.so.7 #4 0x4038a478 in ber_memrealloc_x () from /usr/dot1x/lib/liblber-2.2.so.7 #5 0x40388790 in ber_realloc () from /usr/dot1x/lib/liblber-2.2.so.7 #6 0x403886b4 in ber_write () from /usr/dot1x/lib/liblber-2.2.so.7 #7 0x40387179 in ber_put_tag () from /usr/dot1x/lib/liblber-2.2.so.7 #8 0x40387404 in ber_put_int_or_enum () from /usr/dot1x/lib/liblber-2.2.so.7 #9 0x40388416 in ber_printf () from /usr/dot1x/lib/liblber-2.2.so.7 #10 0x403612f2 in ldap_build_search_req () from /usr/dot1x/lib/libldap-2.2.so.7 #11 0x403611da in ldap_search () from /usr/dot1x/lib/libldap-2.2.so.7 #12 0x40361432 in ldap_search_st () from /usr/dot1x/lib/libldap-2.2.so.7 #13 0x4033f803 in _init () from /usr/dot1x/lib/rlm_ldap-1.1.0.so #14 0x403400d6 in _init () from /usr/dot1x/lib/rlm_ldap-1.1.0.so #15 0x08050c19 in vp_listdebug () #16 0x08050fde in paircmp () #17 0x403f820f in _init () from /usr/dot1x/lib/rlm_files-1.1.0.so #18 0x08057c99 in module_post_auth () #19 0x080582df in modcall () #20 0x08057d0f in module_post_auth () #21 0x08057e06 in module_post_auth () #22 0x08058254 in modcall () #23 0x08057d0f in module_post_auth () #24 0x08057e06 in module_post_auth () #25 0x08058254 in modcall () #26 0x08056fff in find_module_instance () #27 0x080578f0 in module_authorize () #28 0x08053aa3 in rad_authenticate () #29 0x0804dcf8 in rad_respond () #30 0x0805b5a0 in radius_xlat () #31 0x40198ca3 in pthread_detach () from /lib/libpthread.so.0 (gdb) detach Detaching from program: /usr/dot1x/sbin/radiusd, process 17800 (gdb) -------------------------------- it look like deadlock occured when malloc(). is it fixed FreeRADIUS 1.1.6 ? or other problem ? any idea ? we use PEAP, rlm_ldap glibc 2.3.2 openssl 0.9.7g openldap 2.2.27 gcc 3.2.3 Best Regards, S.Obayashi. -------------------------------------- Start Yahoo! Auction now! Check out the cool campaign http://pr.mail.yahoo.co.jp/auction/

3 4

terminater the server
by Diana Robert 25 Jun '07

25 Jun '07

how to terminate the server process. is "kill" method a correct way of terminating..... thanks --------------------------------- The DELETE button on Yahoo! Mail is unhappy. Know why?

1 0

authentication and authorization
by Diana Robert 25 Jun '07

25 Jun '07

radiusd.conf----------------- authenticate{ Auth-Type customer1{ ldap1 } Auth-Type customer2{ ldap2 } } authorize{ preprocess suffix Autz-Type customer1{ ldap1 } Autz-Type customer2{ ldap2 } files } ----------------------------- users file------------------- DEFAULT Realm == "customer1", Autz-Type := customer1, Auth-Type := customer1 if we specify as above, can anyone say wats the difference between authentication and authorization functions. thanks. --------------------------------- Download prohibited? No problem. CHAT from any browser, without download.

2 1

Problem on freeradius+openldap+tls
by Hangjun He 25 Jun '07

25 Jun '07

hi, freeradis with openldap is OK when use cleartext communication. Now I want to use tls. openssl s_client -connect 127.0.0.1:636 -showcerts -state -CAfile /usr/local/etc/openldap/ssl/cacert.pem show the cacert /cert/key is correct. But when I use freeradis with tls, errors pup up: freeradius error: rlm_ldap: - authorize rlm_ldap: performing user authorization for hwang radius_xlat: '(uid=hwang)' radius_xlat: 'ou=People,dc=aerohive,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 127.0.0.1:389, authentication 0 rlm_ldap: setting TLS CACert File to /usr/local/etc/openldap/ssl/cacert.pem rlm_ldap: setting TLS Require Cert to demand rlm_ldap: starting TLS rlm_ldap: ldap_start_tls_s() rlm_ldap: could not start TLS Connect error rlm_ldap: (re)connection attempt failed rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 openldap error: TLS trace: SSL_accept:SSLv3 read client hello A TLS trace: SSL_accept:SSLv3 write server hello A TLS trace: SSL_accept:SSLv3 write certificate A TLS trace: SSL_accept:SSLv3 write server done A tls_write: want=902, written=902 ...... TLS trace: SSL_accept:SSLv3 flush data tls_read: want=5, got=5 0000: 15 03 01 00 02 ..... tls_read: want=2, got=2 0000: 02 2a .* TLS trace: SSL3 alert read:fatal:bad certificate TLS trace: SSL_accept:failed in SSLv3 read client certificate A TLS: can't accept. TLS: error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate s3_pkt.c:1052 connection_read(11): TLS accept failure error=-1 id=5, closing connection_closing: readying conn=5 sd=11 for close connection_close: conn=5 sd=11 daemon: removing 11 When I use freeradius in the same host with openldap, There are other errors: connection_get(10) connection_get(10): got connid=11 connection_read(10): checking for input on id=11 TLS trace: SSL_accept:before/accept initialization TLS trace: SSL_accept:SSLv3 read client hello A TLS trace: SSL_accept:SSLv3 write server hello A TLS trace: SSL_accept:SSLv3 write certificate A TLS trace: SSL_accept:SSLv3 write certificate request A TLS trace: SSL_accept:SSLv3 flush data TLS trace: SSL_accept:error in SSLv3 read client certificate A TLS trace: SSL_accept:error in SSLv3 read client certificate A connection_get(10) connection_get(10): got connid=11 connection_read(10): checking for input on id=11 TLS trace: SSL_accept:SSLv3 read client certificate A TLS trace: SSL_accept:SSLv3 read client key exchange A TLS trace: SSL_accept:SSLv3 read finished A TLS trace: SSL_accept:SSLv3 write change cipher spec A TLS trace: SSL_accept:SSLv3 write finished A TLS trace: SSL_accept:SSLv3 flush data connection_read(10): unable to get TLS client DN, error=49 id=11 connection_get(10) connection_get(10): got connid=11 connection_read(10): checking for input on id=11 ber_get_next ber_get_next: tag 0x30 len 5 contents: ber_get_next TLS trace: SSL3 alert read:warning:close notify partly configuration in slapd.conf: TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSCACertificateFile /usr/local/etc/openldap/ssl/cacert.pem TLSCertificateFile /usr/local/etc/openldap/ssl/servercrt.pem TLSCertificateKeyFile /usr/local/etc/openldap/ssl/serverkey.pem TLSVerifyClient try Can anyone tell me why it is? Anything wrong with my configure file. Thanks! John --------------------------------- 抢注雅虎免费邮箱3.5G容量，20M附件！

1 0

Exec-Program-Wait
by Michael Alexeev 25 Jun '07

25 Jun '07

Hi all, I am having trouble with macro substitution in Exec-Program-Wait attribute. For some reason %C{User-Name} is expanded to "localhost{User-Name}" string instead of real user name. Here is an excerpt from the users config file: jsullivan User-Password == mypass Exec-Program-Wait = "/bin/radius_chain %C{User-Name}" where /bin/radius_chain simply dumps the first parameter to the file: #!/bin/sh param=$1 echo "param=$param" > /bin/test/test.txt exit 0 The content of the /bin/test/test.txt is param=localhost{User-Name} instead of expected param=jsullivan Any ideas what is going on? I am using FreeRadius Version 1.1.6 on linux Thanks, Mike

3 4