- Freeradius-Users - lists.freeradius.org

Maximum Attribute Size
by Matt Dunkin 30 Apr '07

30 Apr '07

Is there any maximum size for the value of an attribute? Thanks, Matt

2 1

FreeRADIUS crash on Solaris 10 after start
by Peter Micunek 30 Apr '07

30 Apr '07

Hi all, I built FreeRADIUS on Solaris 10 ./configure --prefix=/usr/local/freeradius --with-mysql-include-dir=/usr/local/mysql/include/mysql --with-mysql-lib-dir=/usr/local/mysql/lib/mysql --with-openssl-includes=/usr/sfw/include --with-openssl-libraries=/usr/sfw/lib --without-rlm_perl --without-threads make make install and when I want to start FreeRADIUS it crash: # radiusd -X Config: including file: /usr/local/freeradius/etc/raddb/radiusd.conf Config: including file: /usr/local/freeradius/etc/raddb/proxy.conf Config: including file: /usr/local/freeradius/etc/raddb/clients.conf Config: including file: /usr/local/freeradius/etc/raddb/snmp.conf Config: including file: /usr/local/freeradius/etc/raddb/eap.conf Config: including file: /usr/local/freeradius/etc/raddb/sql.conf Config: including file: /usr/local/freeradius/etc/raddb/sql/mysql- dialup.conf FreeRADIUS Version 2.0.0-pre0, for host sparc-sun-solaris2.10, built on Apr 30 2007 at 11:11:35 Starting - reading configuration files ... read_config_files: reading dictionary zsh: bus error (core dumped) radiusd -X # dbx - core Corefile specified executable: "/usr/local/freeradius/sbin/radiusd" For information about new features see `help changes' To remove this message, put `dbxenv suppress_startup_message 7.5' in your .dbxrc Reading radiusd core file header read successfully Reading ld.so.1 Reading libradius-2.0.0-pre0.so Reading libnsl.so.1 Reading libresolv.so.2 Reading libsocket.so.1 Reading libcrypt_i.so.1 Reading libltdl.so.3.1.0 Reading libdl.so.1 Reading libssl.so.0.9.7 Reading libcrypto.so.0.9.7 Reading libc.so.1 Reading libgcc_s.so.1 Reading libgen.so.1 Reading libc_psr.so.1 program terminated by signal BUS (invalid address alignment) Current function is lrad_isaac (optimized) 37 rngstep( a<<13, a, b, mm, m, m2, r, x); I have same problem with FR 1.1.6. Can you help me fix this problem? My settings: # gcc -v Using built-in specs. Target: sparc-sun-solaris2.10 Configured with: /net/tibia/export/bldmstr/nightly/20061019_mars_gcc.s10.opt.tarbuild/src/configure --prefix=/opt/gcc --enable-shared --with-system-zlib --enable-checking=release --disable-libmudflap --enable-languages=c,c++ --enable-version-specific-runtime-libs --with-gxx-include-dir=/opt/gcc/include/c++/4.0.3 --with-cpu=v9 Thread model: posix gcc version 4.0.3 (gccfss) LD_LIBRARY_PATH=/lib:/usr/local/lib:/usr/sfw/lib:/usr/ccs/lib:/usr/lib:/usr/local/mysql/lib/mysql:/usr/local/freeradius/lib LDFLAGS=-L/usr/local/lib -R/usr/local/lib -L/usr/local/mysql/lib/mysql -R/usr/local/mysql/lib/mysql -L/usr/sfw/lib -R/usr/sfw/lib -L/usr/ccs/lib -R/usr/ccs/lib -L/usr/local/freeradius/lib -R/usr/local/freeradius/lib PATH=/opt/gcc/bin:/usr/local/bin:/usr/sbin:/usr/bin:/usr/local/mysql/bin:/usr/local/sbin:/opt/csw/bin:/opt/csw/sbin:/usr/sfw/bin:/usr/sfw/sbin:/usr/local/freeradius/sbin:/usr/local/freeradius/bin:/usr/ccs/bin best regards Peter Micunek

2 3

No available IP Addresses in the pool ...
by Florin 30 Apr '07

30 Apr '07

Hello everyone, FreeRadius 1.0.1 from RHEL 4. I get the following error (only shown in debug mode) after 1-2 weeks of server working fine, without any issues: rlm_ippool: Searching for an entry for nas/port: 172.25.254.218/9931392 rlm_ippool: No available ip addresses in pool. modcall[post-auth]: module "<pool_name>" returns notfound for request 0 The outcome of this error is that the client is not issued any IP address (which is a show stopper). Here is the pool declaration: # IP pool used by ************ #---------------------------------- ippool *************** { range-start = 172.26.4.1 range-stop = 172.26.5.254 netmask = 255.255.254.0 cache-size = 300 session-db = ${raddbdir}/ippools/*********-db.ippool ip-index = ${raddbdir}/ippools/*********-db.ipindex override = no maximum-timeout = 86400 } The only fix so far was to remove the pool files and recreate them again. Any thoughts of what could be wrong ? Many thanks in advance. Regards, Florin

3 2

checkrad + NoCat
by Milan Holub 30 Apr '07

30 Apr '07

Hi all, I was wondering whether nocat (http://nocat.net/) could be queried for simultaneous use somehow. I've found only some outdated patch on http://lists.nocat.net/pipermail/nocat/2003-October/003795.html I've inspired from the idea and attached is a patch to checkrad.pl.in. You need additional perl module HTTP::Lite(downloadable from CPAN). I've tested and it's working well. In order to deploy checkrad you need to set your nas type to "nocat" and enable simultaneous-use checking for your user(Simultaneous-Use:=1 in users file|radcheck|radgroupcheck) and your freeradius server has to be allowed in NAS firewall to access http://$nas_ip:$nas_port/status NAS> iptables -A INPUT -p tcp --dport <$nas_port> -s <$radius_server> -j ACCEPT I hope this can help someone... Milan Holub holub (at) thenet (dot) ch -------------------------------------- TheNet-Internet Services AG, im Bernertechnopark, Morgenstr. 129 CH-3018, Bern, Switzerland 031 998 4333, Fax 031 998 4330 http://www.thenet.ch http://wlan.thenet.ch --------------------------------------

1 0

request from unknown NAS vulnerability
by Milan Holub 30 Apr '07

30 Apr '07

Hi Alan, with latest cvs head: * NASes in database * when sending 1 access request from NAS not defined in NAS table I get following repeating error message (-X) flooding my screen: Nothing to do. Sleeping until we see a request. Ignoring request from unknown client <IP_NOT_IN_NAS_TABLE> port 43508 Server does not react on HUPs and stops responding to NASes defined correctly in NAS table. Is there something wrong with request cleanup for unknown client? Please advise. Milan Holub holub (at) thenet (dot) ch -------------------------------------- TheNet-Internet Services AG, im Bernertechnopark, Morgenstr. 129 CH-3018, Bern, Switzerland 031 998 4333, Fax 031 998 4330 http://www.thenet.ch http://wlan.thenet.ch --------------------------------------

2 2

Accounting packets & segmentation fault
by Milan Holub 30 Apr '07

30 Apr '07

Hi Alan, I'm back with my bug reports:) In latest cvs head: When sending following packet: `cat ./admin_reset_acct.txt`: NAS-Port = 5282 NAS-IP-Address = <IP_IN_NAS_TABLE> Acct-Status-Type = Accounting-On Acct-Terminate-Cause = Admin-Reset ... but it looks like it behaves the same for all accounting packets! I'm getting segmentation fault: Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 1024 (LWP 18106)] 0x08052d67 in acct_socket_recv (listener=0x815be70, pfun=0xbfffe9fc, prequest=0xbfffea00) at listen.c:500 500 switch(packet->code) { (gdb) (gdb) (gdb) bt #0 0x08052d67 in acct_socket_recv (listener=0x815be70, pfun=0xbfffe9fc, prequest=0xbfffea00) at listen.c:500 #1 0x0805923f in main (argc=2, argv=0xbffffb94) at radiusd.c:643 (gdb) list 495 } 496 497 /* 498 * Some sanity checks, based on the packet code. 499 */ 500 switch(packet->code) { 501 case PW_ACCOUNTING_REQUEST: 502 RAD_SNMP_CLIENT_INC(listener, client, requests); 503 fun = rad_accounting; 504 break; (gdb) print packet->code Cannot access memory at address 0x1016e67 (gdb) print packet $1 = (RADIUS_PACKET *) 0x1016e33 gdb) print packet->src_ipaddr Cannot access memory at address 0x1016e37 (gdb) print packet->src_port Cannot access memory at address 0x1016e5f (gdb) print packet->id Cannot access memory at address 0x1016e63 (gdb) print packet->sockfd Cannot access memory at address 0x1016e33 (gdb) print packet->timestamp Cannot access memory at address 0x1016e7f Milan Holub holub (at) thenet (dot) ch -------------------------------------- TheNet-Internet Services AG, im Bernertechnopark, Morgenstr. 129 CH-3018, Bern, Switzerland 031 998 4333, Fax 031 998 4330 http://www.thenet.ch http://wlan.thenet.ch --------------------------------------

2 1

perl app
by Jacob Jarick 30 Apr '07

30 Apr '07

1 0

Thanks alot everyone
by Jacob Jarick 30 Apr '07

30 Apr '07

Thanks very much everyone, specially Phil, Alan and the rest who helped me but I cant recall just now. I Have fiiinally got it going (properly this time to). Here is a quick outline of my setup, I may write a detailed howto later on. Windows XP home client -> cisco wap -> freeradius on Fedora -> Windows 2003 ADS FREERADIUS: I used EAP-TTLS as the encryption / tunneling. Used certs (needed for TTLS) that came with rpm. Used PAP inside of EAP-TTLS (sends plain text password which ldap expects) WINDOWS SERVER: * Add 1 user with password for ldap searching (cant remember if user needs special permision to search LDAP). * Fortunately not much config is needed on the server, enabling anonymous LDAP searching is very handy when figuring out a new domain and its users. WINDOWS XP CLIENTS: I reccomend using SecureW2 on XP clients as it allows you to use PAP inside of EAP. Configure clients with these options: My windows client details: Network Authentication: Open Data Encryption: WEP the key is provided for me automatically: (ticked) EAP type: SecureW2 Authenticate as a computer: (unticked) Authenticate as a guest: (unticked) Securew2 config details: use alternate outer identity: (unticked) verify server cert: (unticked) Select Authentication Method: PAP Prompt user for credentials: (ticked) http://www.securew2.com/

1 0

Help please: "auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user"
by Jacob Jarick 30 Apr '07

30 Apr '07

radiusd.conf: http://pastebin.ca/465399 radius -X output: http://pastebin.ca/465404 After following phils guide on the weekend I successfully got both radtest and radping to return auth-accept packets. The default windows client wouldnt auth but they dont do PAP as I undertstand. I am currently using http://www.securew2.org to enable PAP though I am getting this error. ERROR: auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user My windows client details: Network Authentication: Open Data Encryption: WEP the key is provided for me automatically: (ticked) EAP type: SecureW2 Authenticate as a computer: (unticked) Authenticate as a guest: (unticked) Scurew2 config details: use alternate outer identity: (unticked) verify server cert: (unticked) Select Authentication Method: PAP Prompt user for credentials: (ticked) I am using the SecureW2 client / extension because I have been told numerous times that LDAP only supports PAP and its been suggested that I get PAP working before anything else (let me know if Im on the right track with SecureW2). So Im guessing here, but the reason it fails is because I do not have eap & pap modules configured ? Thanks for the help again guys.

1 1

RE: FR 1.1.6 EAP - TLS rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal bad_certificate
by Remy de Ruysscher 29 Apr '07

29 Apr '07

Hi David, Thanks for your help! I use the port version of FR and also use portupgrade. The FreeBSD base OpenSSL is indeed rather old, so I did have OpenSSL (With_overwrite_Base) already installed from the ports. I found something wrong with the server certificates (very strange, because nothing has been altered). I don't know what this means (yet). I'm rebuilding my OpenSSL port with make clean && make reinstall and have removed all files in /usr/local/etc/raddb. So FR the port will install a clean version. Then I will compare files manually and see what changes there have been. --- defiant.unix.asp.com.pem: /C=NL/ST=Utrecht/L=Utrecht/O=UNIX-ASP.COM/OU=Support/CN=unix-asp.com/emailAd dress=support(a)unix-asp.com error 18 at 0 depth lookup:self signed certificate /C=NL/ST=Utrecht/L=Utrecht/O=UNIX-ASP.COM/OU=Support/CN=unix-asp.com/emailAd dress=support(a)unix-asp.com error 7 at 0 depth lookup:certificate signature failure 25385:error:0407006A:rsa routines:RSA_padding_check_PKCS1_type_1:block type is not 01:/usr/src/secure/lib/libcrypto/../../../crypto/openssl/crypto/rsa/rsa_pk1. c:100: 25385:error:04067072:rsa routines:RSA_EAY_PUBLIC_DECRYPT:padding check failed:/usr/src/secure/lib/libcrypto/../../../crypto/openssl/crypto/rsa/rsa_ eay.c:625: 25385:error:0D089006:asn1 encoding routines:ASN1_verify:EVP lib:/usr/src/secure/lib/libcrypto/../../../crypto/openssl/crypto/asn1/a_veri fy.c:162: Regards, Remy. -----Original Message----- From: freeradius-users-bounces+remy=unix-asp.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+remy=unix-asp.com@lists.freeradius.org] On Behalf Of David Wood Sent: zondag 29 april 2007 0:38 To: FreeRadius users mailing list Subject: Re: FR 1.1.6 EAP - TLS rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal bad_certificate Hi Remy and everyone, In message <200704281849.l3SInfTu086460(a)mxdrop40.xs4all.nl>, Remy de Ruysscher <remy(a)unix-asp.com> writes >I just upgrade FR 1.1.4 to 1.1.6 on FreeBSD 6.1. And FR has always >worked wonderfully for me in the past. I'm the maintainer of the FreeBSD port. My 6.2-RELEASE-p2 i386 system uses EAP-TLS - and it works fine, so it is probably something with your setup. I'm assuming you're using the port - though you didn't say so specifically. I use the OpenSSL port - and suggest you do too, as the version of OpenSSL in the base system is rather old. If you've got the OpenSSL port installed, the FreeRADIUS port will notice and make use of it automatically. The package, meanwhile, uses the base OpenSSL. If you install the OpenSSL port, you'll need to rebuild the FreeRADIUS port for FreeRADIUS to use it. If you have portupgrade installed, and want to switch to using the OpenSSL port, try: portupgrade -N security/openssl portupgrade -f net/freeradius /usr/local/etc/rc.d/radius start I suggest you also rebuild any other ports that use OpenSSL if you've installed the OpenSSL port for the first time. Use portupgrade -f or similar. Of course, it could be that your server certificate is actually bad. Do the results of: openssl verify -CAfile demoCA/cacert.pem -verbose cert-srv.pem and openssl x509 -in cert-srv.pem -noout -text look OK? You may need to adjust the filenames according to your environment - I'm presuming that you're in your raddb certificates folder. If you have the OpenSSL port installed, I suggest you explicitly use /usr/local/bin/openssl instead of openssl in the commands above. The handling of raddb upgrading has changed significantly from version 1.1.4 of the port to 1.1.6. It's just possible that your certificates have got stomped on if they are in /usr/local/etc/raddb/certs (adjusted accordingly if you have a non-standard ${PREFIX}), but I can't think why, as the script is fairly careful in checking before overwriting anything in raddb. That said, the new behaviour on uninstallation is to check any files in raddb against the distribution, and delete unmodified files. On installation, it copies the distribution files to raddb unless there's already a file of the same name. It's possible that your upgrade to 1.1.6 has created mixed versions (new uncustomised files and your customisations based on a rather older version of FreeRADIUS) - and that's introduced a problem, though I feel this is unlikely. My favourite is either there's something wrong with your server certificate, or it's a problem with the base system OpenSSL that you can cure by moving to the OpenSSL port. I'd be interested to know how you get on, particularly if the problem turns out to be something different. If you want a tarball of the 1.1.4 port, email me - I can pull out the last version of 1.1.4 from my local Subversion repository before I upgraded the port to 1.1.5. There were a lot of fixes in the 1.1.4 timeframe - there was a 1.1.4 port on 15 January 2007, 1.1.4_1 on 18 January 2007, and a rewrap of 1.1.4_1 on 23 January 2007. The 15 January -> 18 January transition merely disabled rlm_sql_firebird (otherwise the port failed to build with experimental modules disabled). The 18 January -> 23 January 2007 update contained a bunch of fixes, including the first version of the revised raddb handling (the very first time that the port touched files other than those suffixed .sample in raddb). http://www.freshports.org/net/freeradius/ will walk you through the changes in more detail, though my local Subversion repository is more finely grained. There were two further changes before I upgraded to 1.1.5 - support for the freeradius-mysql slave port, and a change to the current version of raddb handling. However, I hope we can get the 1.1.6 port working on your machine, and I don't have to unravel the many changes made from the last version of 1.1.4_1 through 1.1.5 to 1.1.6. Best wishes, David -- David Wood david(a)wood2.org.uk - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0