- Freeradius-Users - lists.freeradius.org

RE: terminating EAP tunnels, proxy and realms
by Josh Howlett 25 Jun '07

25 Jun '07

> > Nope; see RFC 3579 for the gory details: > > > > "the NAS MUST copy the contents of the Type-Data field of the > > EAP-Response/Identity received from the peer into the User-Name > > attribute" > > > > See thats what I suspected, else how could the User-Name > attribute be populated in the access requests... > And indeed as the RFC states, the User-Identity needs to be > set in the access requests for none EAP aware proxies. I > suspect FreeRADIUS may count as one of these, as for all > intensive purposes as it provides no mechanism to proxy > arbitrary segments of an EAP conversation on inner identity alone. > Unless I missed something ? No, that's correct. > > For the reason given above, it *does* need to understand the > > EAP-Identity-Response. But that's about it! The NAS is a > pretty dumb > > device. > > Reason why I was asking is because most of the tests on the > JRS test website seem to break when you base the reply in > FreeRADIUS, on the inner identity as opposed to the outer identity. I'm surprised at that, IIRC (and I did write the code originally :-) the tests use the same name for inner and outer. Still, it would probably be best if you raised a ticket with JANET Customer Services as this is a bit OT for this list. best regards, josh.

1 0

cvs.freeradius.org failure?
by Milan Holub 25 Jun '07

25 Jun '07

Hi Alan, is it possible that something is wrong with freeradius cvs? I can't log in as anoncvs nor I can do diffs or whatever. Client just hangs - eg.: `cvs -d:pserver:anoncvs@cvs.freeradius.org:/source login` Logging in to :pserver:anoncvs@cvs.freeradius.org:2401/source CVS password: ==> nothing happens for a long time cvs [login aborted]: received interrupt signal ==> killed by ctrl-c Please advise. With regards. Milan Holub holub (at) thenet (dot) ch -------------------------------------- TheNet-Internet Services AG, im Bernertechnopark, Morgenstr. 129 CH-3018, Bern, Switzerland 031 998 4333, Fax 031 998 4330 http://www.thenet.ch http://wlan.thenet.ch --------------------------------------

2 2

radiusd stop responding. deadlock?
by blue_11j＠yahoo.co.jp 25 Jun '07

25 Jun '07

Hi, I'm *sorry* that I am not good at English because I'm Japanese. We using freeradius 1.1.0 for PEAP authentication, and it is working well almost. but sometime, radiusd stops responding.CPU usage is 100%. (need to radiusd stop/start). following is result of ps. -------------------------------- #ps -efml | grep radius 1 S root 10134 10127 0 69 0 - 7395 148a46 Jun19 ? 00:00:00 /usr/dot1x/sbin/radiusd -d /e tc/raddb -l syslog -g local0 -x 1 S root 17737 10134 0 69 0 - 7395 10800b Jun19 ? 00:00:01 /usr/dot1x/sbin/radiusd -d /e tc/raddb -l syslog -g local0 -x 1 S root 17835 10134 0 68 0 - 7395 10800b Jun19 ? 00:00:00 /usr/dot1x/sbin/radiusd -d /e tc/raddb -l syslog -g local0 -x 0 R root 10127 1 47 80 0 - 7395 - Jun19 ? 19:24:13 /usr/dot1x/sbin/radiusd -d /e tc/raddb -l syslog -g local0 -x 1 S root 17769 10134 0 69 0 - 7395 10800b Jun19 ? 00:00:01 /usr/dot1x/sbin/radiusd -d /e tc/raddb -l syslog -g local0 -x 1 R root 17800 10134 49 76 0 - 7395 - Jun19 ? 19:19:02 /usr/dot1x/sbin/radiusd -d /e tc/raddb -l syslog -g local0 -x 1 S root 17713 10134 0 69 0 - 7395 10800b Jun19 ? 00:00:01 /usr/dot1x/sbin/radiusd -d /e tc/raddb -l syslog -g local0 -x -------------------------------- pid:10127(main) eats 47% CPU. pid:17800 eats 49% CPU. following is result of gdb about these thread. -------------------------------- # gdb GNU gdb 5.3 Copyright 2002 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-slackware-linux". (gdb) attach 10127 Attaching to process 10127 Reading symbols from /usr/dot1x/sbin/radiusd...(no debugging symbols found)... done. ....(snip)... 0x4019a072 in pthread_once () from /lib/libpthread.so.0 (gdb) where #0 0x4019a072 in pthread_once () from /lib/libpthread.so.0 #1 0x4027df03 in malloc () from /lib/libc.so.6 #2 0x401eae87 in rad_recv () from /usr/dot1x/lib/libradius-1.1.0.so #3 0x0804d78b in main () #4 0x4021cd06 in __libc_start_main () from /lib/libc.so.6 (gdb) detach Detaching from program: /usr/dot1x/sbin/radiusd, process 10127 (gdb) (gdb) (gdb) attach 10127 Attaching to program: /usr/dot1x/sbin/radiusd, process 10127 Symbols already loaded for /lib/libcrypt.so.1 ....(snip)... 0x401998cc in pthread_mutex_trylock () from /lib/libpthread.so.0 (gdb) whrere #0 0x401998cc in pthread_mutex_trylock () from /lib/libpthread.so.0 #1 0x4027c65f in _IO_file_xsputn () from /lib/libc.so.6 #2 0x4027df03 in malloc () from /lib/libc.so.6 #3 0x401eae87 in rad_recv () from /usr/dot1x/lib/libradius-1.1.0.so #4 0x0804d78b in main () #5 0x4021cd06 in __libc_start_main () from /lib/libc.so.6 (gdb) detach Detaching from program: /usr/dot1x/sbin/radiusd, process 10127 (gdb) (gdb) attach 17800 Attaching to program: /usr/dot1x/sbin/radiusd, process 17800 Symbols already loaded for /lib/libcrypt.so.1 ....(snip)... 0x4027f4b0 in mallopt () from /lib/libc.so.6 (gdb) (gdb) where #0 0x4027f4b0 in mallopt () from /lib/libc.so.6 #1 0x4027ed83 in mallopt () from /lib/libc.so.6 #2 0x4027df1a in malloc () from /lib/libc.so.6 #3 0x4038a2e9 in ber_memalloc_x () from /usr/dot1x/lib/liblber-2.2.so.7 #4 0x4038a478 in ber_memrealloc_x () from /usr/dot1x/lib/liblber-2.2.so.7 #5 0x40388790 in ber_realloc () from /usr/dot1x/lib/liblber-2.2.so.7 #6 0x403886b4 in ber_write () from /usr/dot1x/lib/liblber-2.2.so.7 #7 0x40387179 in ber_put_tag () from /usr/dot1x/lib/liblber-2.2.so.7 #8 0x40387404 in ber_put_int_or_enum () from /usr/dot1x/lib/liblber-2.2.so.7 #9 0x40388416 in ber_printf () from /usr/dot1x/lib/liblber-2.2.so.7 #10 0x403612f2 in ldap_build_search_req () from /usr/dot1x/lib/libldap-2.2.so.7 #11 0x403611da in ldap_search () from /usr/dot1x/lib/libldap-2.2.so.7 #12 0x40361432 in ldap_search_st () from /usr/dot1x/lib/libldap-2.2.so.7 #13 0x4033f803 in _init () from /usr/dot1x/lib/rlm_ldap-1.1.0.so #14 0x403400d6 in _init () from /usr/dot1x/lib/rlm_ldap-1.1.0.so #15 0x08050c19 in vp_listdebug () #16 0x08050fde in paircmp () #17 0x403f820f in _init () from /usr/dot1x/lib/rlm_files-1.1.0.so #18 0x08057c99 in module_post_auth () #19 0x080582df in modcall () #20 0x08057d0f in module_post_auth () #21 0x08057e06 in module_post_auth () #22 0x08058254 in modcall () #23 0x08057d0f in module_post_auth () #24 0x08057e06 in module_post_auth () #25 0x08058254 in modcall () #26 0x08056fff in find_module_instance () #27 0x080578f0 in module_authorize () #28 0x08053aa3 in rad_authenticate () #29 0x0804dcf8 in rad_respond () #30 0x0805b5a0 in radius_xlat () #31 0x40198ca3 in pthread_detach () from /lib/libpthread.so.0 (gdb) detach Detaching from program: /usr/dot1x/sbin/radiusd, process 17800 (gdb) -------------------------------- it look like deadlock occured when malloc(). is it fixed FreeRADIUS 1.1.6 ? or other problem ? any idea ? we use PEAP, rlm_ldap glibc 2.3.2 openssl 0.9.7g openldap 2.2.27 gcc 3.2.3 Best Regards, S.Obayashi. -------------------------------------- Start Yahoo! Auction now! Check out the cool campaign http://pr.mail.yahoo.co.jp/auction/

3 4

terminater the server
by Diana Robert 25 Jun '07

25 Jun '07

how to terminate the server process. is "kill" method a correct way of terminating..... thanks --------------------------------- The DELETE button on Yahoo! Mail is unhappy. Know why?

1 0

authentication and authorization
by Diana Robert 25 Jun '07

25 Jun '07

radiusd.conf----------------- authenticate{ Auth-Type customer1{ ldap1 } Auth-Type customer2{ ldap2 } } authorize{ preprocess suffix Autz-Type customer1{ ldap1 } Autz-Type customer2{ ldap2 } files } ----------------------------- users file------------------- DEFAULT Realm == "customer1", Autz-Type := customer1, Auth-Type := customer1 if we specify as above, can anyone say wats the difference between authentication and authorization functions. thanks. --------------------------------- Download prohibited? No problem. CHAT from any browser, without download.

2 1

Problem on freeradius+openldap+tls
by Hangjun He 25 Jun '07

25 Jun '07

hi, freeradis with openldap is OK when use cleartext communication. Now I want to use tls. openssl s_client -connect 127.0.0.1:636 -showcerts -state -CAfile /usr/local/etc/openldap/ssl/cacert.pem show the cacert /cert/key is correct. But when I use freeradis with tls, errors pup up: freeradius error: rlm_ldap: - authorize rlm_ldap: performing user authorization for hwang radius_xlat: '(uid=hwang)' radius_xlat: 'ou=People,dc=aerohive,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 127.0.0.1:389, authentication 0 rlm_ldap: setting TLS CACert File to /usr/local/etc/openldap/ssl/cacert.pem rlm_ldap: setting TLS Require Cert to demand rlm_ldap: starting TLS rlm_ldap: ldap_start_tls_s() rlm_ldap: could not start TLS Connect error rlm_ldap: (re)connection attempt failed rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 openldap error: TLS trace: SSL_accept:SSLv3 read client hello A TLS trace: SSL_accept:SSLv3 write server hello A TLS trace: SSL_accept:SSLv3 write certificate A TLS trace: SSL_accept:SSLv3 write server done A tls_write: want=902, written=902 ...... TLS trace: SSL_accept:SSLv3 flush data tls_read: want=5, got=5 0000: 15 03 01 00 02 ..... tls_read: want=2, got=2 0000: 02 2a .* TLS trace: SSL3 alert read:fatal:bad certificate TLS trace: SSL_accept:failed in SSLv3 read client certificate A TLS: can't accept. TLS: error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate s3_pkt.c:1052 connection_read(11): TLS accept failure error=-1 id=5, closing connection_closing: readying conn=5 sd=11 for close connection_close: conn=5 sd=11 daemon: removing 11 When I use freeradius in the same host with openldap, There are other errors: connection_get(10) connection_get(10): got connid=11 connection_read(10): checking for input on id=11 TLS trace: SSL_accept:before/accept initialization TLS trace: SSL_accept:SSLv3 read client hello A TLS trace: SSL_accept:SSLv3 write server hello A TLS trace: SSL_accept:SSLv3 write certificate A TLS trace: SSL_accept:SSLv3 write certificate request A TLS trace: SSL_accept:SSLv3 flush data TLS trace: SSL_accept:error in SSLv3 read client certificate A TLS trace: SSL_accept:error in SSLv3 read client certificate A connection_get(10) connection_get(10): got connid=11 connection_read(10): checking for input on id=11 TLS trace: SSL_accept:SSLv3 read client certificate A TLS trace: SSL_accept:SSLv3 read client key exchange A TLS trace: SSL_accept:SSLv3 read finished A TLS trace: SSL_accept:SSLv3 write change cipher spec A TLS trace: SSL_accept:SSLv3 write finished A TLS trace: SSL_accept:SSLv3 flush data connection_read(10): unable to get TLS client DN, error=49 id=11 connection_get(10) connection_get(10): got connid=11 connection_read(10): checking for input on id=11 ber_get_next ber_get_next: tag 0x30 len 5 contents: ber_get_next TLS trace: SSL3 alert read:warning:close notify partly configuration in slapd.conf: TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSCACertificateFile /usr/local/etc/openldap/ssl/cacert.pem TLSCertificateFile /usr/local/etc/openldap/ssl/servercrt.pem TLSCertificateKeyFile /usr/local/etc/openldap/ssl/serverkey.pem TLSVerifyClient try Can anyone tell me why it is? Anything wrong with my configure file. Thanks! John --------------------------------- 抢注雅虎免费邮箱3.5G容量，20M附件！

1 0

Exec-Program-Wait
by Michael Alexeev 25 Jun '07

25 Jun '07

Hi all, I am having trouble with macro substitution in Exec-Program-Wait attribute. For some reason %C{User-Name} is expanded to "localhost{User-Name}" string instead of real user name. Here is an excerpt from the users config file: jsullivan User-Password == mypass Exec-Program-Wait = "/bin/radius_chain %C{User-Name}" where /bin/radius_chain simply dumps the first parameter to the file: #!/bin/sh param=$1 echo "param=$param" > /bin/test/test.txt exit 0 The content of the /bin/test/test.txt is param=localhost{User-Name} instead of expected param=jsullivan Any ideas what is going on? I am using FreeRadius Version 1.1.6 on linux Thanks, Mike

3 4

accounting.
by Diana Robert 25 Jun '07

25 Jun '07

hi all, how is accounting implemented in freeradius in case of a prepaid user? thank you. --------------------------------- The DELETE button on Yahoo! Mail is unhappy. Know why?

1 0

EAP-TTLS PAP Mysql problems
by emmcosta 24 Jun '07

24 Jun '07

Hi everyone, I already configured my freeradius with eap-ttls pap with authentication on mysql. I obtain authentication, but logs some lines: Wed Jun 20 19:46:47 2007 : Error: Trying to look up name of unknown client 127.0.0.1. Wed Jun 20 19:46:47 2007 : Auth: Login OK: [teste/secret] (from client UNKNOWN-CLIENT port 327 cli 0040.96a2.24f3) Wed Jun 20 19:46:47 2007 : Auth: Login OK: [teste/<no User-Password attribute>] (from client ap2 port 327 cli 0040.96a2.24f3) My radiusd.conf: .................... authorize { preprocess sql pap } authenticate{ Auth-Type PAP { pap } eap } ...................... My eap.conf: eap{ default_eap_type = ttls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = yes gtc { auth_type = PAP } tls { private_key_password = whatever private_key_file = ${raddbdir}/certs/cert-srv.pem certificate_file = ${raddbdir}/certs/cert-srv.pem CA_file = ${raddbdir}/certs/demoCA/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random } ttls { default_eap_type = gtc copy_request_to_tunnel = yes use_tunneled_reply = yes } } What it is that I need put in mysql and my configuration, for before I obtain good authentication return: Tunnel-Type, Tunnel-Medium-Type and Tunnel-Private-Group-ID for the client make a dhclient in vlan I return? Best Regards -- /emmc

5 12

Probelms importing usage to rodopi
by Jeff 23 Jun '07

23 Jun '07

Importing Accounting Detail to Rodopi 5.4 As anyone implememnted this and willing to share their configuration. I am having issues with what i come up with. First I have Freeradius only creating one detail file with no date extension, etc. Next I have a cron job run every 12 hours, I like everything to be about every 10 minutes but thats a not the story I went this long to watch for a bug, and plenty are crawling around anyway. The cron moves the acccounting file to /home/rodopi/radius changes owner and group to rodopi and permissions to 666 Next I have rodoppi inport usage about every 12 hours, which i figure its time frame should be off, and not miss a detail import where he cron moves the files to the /home/rodopi/radius and overwrite a detail file thus missing data anyway Rodopi ftps in grabs the file renames the old one as it should to old_detail* I go into rodopi and I am not seeing any imported usage for customers I go look for. My guess some are probably making it in, but I am seeing none. Wither a usage was imported with a stop, my guess as one of them or something just isn't right elsewhere. Now any suggestions, on what may be happeing or has someone else come up with a better idea that this they would like to share to import the usage data?

1 0