- Freeradius-Users - lists.freeradius.org

Strange problems in large proxy setup
by Kostas Zorbadelos 26 Feb '07

26 Feb '07

My greetings to the list. We have deployed a large setup using freeradius 1.1.3 in a proxy configuration in front of FUNK radius. During the day we have about 150.000 concurrent DSL users online. Our setup takes the access-request from the NAS, checks whether the user has any other active sessions and if he is allowed to have a session the request is proxied to the FUNK server that performs the actual authentication. So the setup is a classical proxy setup. This policy decision of whether the user is allowed to have a session is taken by a module we have developed for this purpose (we call it rlm_concurrency). We use the ldap module to find the maximum allowed sessions for a user. Our setup involves no accounting, just authentication/authorization. ------- -------------- -------- | NAS | -----> | Freeradius | <-------> | FUNK | ------- -------------- -------- This is the actual config we have in our freeradius server: authorize { preprocess # The following config instructs freeradius to stop processing # requests if it matches the user in the local users file files { ok = return } ldap concurrency suffix } Here is a debugging output from freeradius with this config: ============== Debugging output (radiusd -X) ====================== Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 62.103.1.111:1645, id=4, length=127 Framed-Protocol = PPP User-Name = "foouser" User-Password = "XXXXXX" Calling-Station-Id = "XXXXXXXXX" NAS-Port-Type = Async Connect-Info = "33600/31200 V34+/V42bis/LAPM" NAS-Port = 4115 NAS-Port-Id = "Async2/2" Service-Type = Framed-User NAS-IP-Address = 62.103.1.111 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 9 modcall[authorize]: module "preprocess" returns ok for request 9 modcall[authorize]: module "files" returns notfound for request 9 rlm_ldap: - authorize rlm_ldap: performing user authorization for foouser radius_xlat: '(&(uid=foouser)(radiusAccountStatus=activated))' radius_xlat: '...' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=..., with filter (&(uid=foouser)(radiusAccountStatus=activated)) rlm_ldap: looking for check items in directory... rlm_ldap: Adding radiusMaxLogins as Simultaneous-Use, value 1 & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user foouser authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 9 rlm_concurrency: Found NAS-IP-Address: 62.103.1.111 rlm_concurrency: User: foouser, Max-Sessions found: 1 rlm_concurrency: Accepted User foouser. Active sessions: 0, Maximum allowed sessions: 1 modcall[authorize]: module "concurrency" returns ok for request 9 rlm_realm: No '@' in User-Name = "foouser", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Proxying request from user foouser to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Preparing to proxy authentication request to realm "NULL" modcall[authorize]: module "suffix" returns updated for request 9 modcall: leaving group authorize (returns updated) for request 9 Sending Access-Request of id 9 to YYYY port 1645 Framed-Protocol = PPP User-Name = "foouser" User-Password = "XXXXXX" Calling-Station-Id = "XXXXXXXXXXXXXX" NAS-Port-Type = Async Connect-Info = "33600/31200 V34+/V42bis/LAPM" NAS-Port = 4115 NAS-Port-Id = "Async2/2" Service-Type = Framed-User NAS-IP-Address = 62.103.1.111 Proxy-State = 0x34 --- Walking the entire request list --- Waking up in 0 seconds... ... Waking up in 0 seconds... rad_recv: Access-Accept packet from host YYYY, id=9, length=107 Proxy-State = 0x34 Class = 0x5342522d434c20444e3d22646570616b222041543d22323030222055533d22222053493d223630373737383736302200 Filter-Id = "USER-FILTER-OUT.out" Framed-Protocol = PPP Service-Type = Framed-User authorize: Skipping authorize in post-proxy stage rad_check_password: Found Auth-Type rad_check_password: Auth-Type = Accept, accepting the user Login OK: [foouser] (from client KARP3845 port 4115 cli 2237021227) Sending Access-Accept of id 4 to 62.103.1.111 port 1645 Class = 0x5342522d434c20444e3d22646570616b222041543d22323030222055533d22222053493d223630373737383736302200 Filter-Id = "USER-FILTER-OUT.out" Framed-Protocol = PPP Service-Type = Framed-User ============== End Debugging output (radiusd -X) ====================== We have noticed no problems with our module and also no problems whatsoever in a low traffic testing environment. However we have observed the following strange behaviour in our production setup with its high volume of requests. In a normal authentication request, we get the following lines in radius.log in case of succesfull authentication: Fri Feb 23 13:04:46 2007 : Info: rlm_concurrency: Accepted User kzorba. Active sessions: 0, Maximum allowed sessions: 2 Fri Feb 23 13:04:46 2007 : Auth: Login OK: [kzorba] (from client KARP3845 port 4099 cli 2103841077) In case of user rejection in the FUNK server we get: Fri Feb 23 13:04:46 2007 : Info: rlm_concurrency: Accepted User foouser. Active sessions: 0, Maximum allowed sessions: 1 Fri Feb 23 00:22:39 2007 : Auth: Login incorrect (Home Server says so): [foouser] (from client ATHE10KI port 1128333394 cli atm 4) In some cases though, freeradius seems to reject the user (and the FUNK server makes no log in this scenario). We make successive access requests lets say for user kzorba (with valid credentials). In most cases everything works OK, but in some cases we get: Fri Feb 23 13:04:14 2007 : Info: rlm_concurrency: Accepted User kzorba. Active sessions: 0, Maximum allowed sessions: 2 Fri Feb 23 13:04:14 2007 : Auth: Login incorrect: [kzorba] (from client KARP3845 port 4102 cli 2103841077) The rejection does not seem to come from the home FUNK server. We have run freeradius in debug mode in testing environment (output given above) and everything seem to work fine with our configuration, however in our production setup only with its high traffic we get these random failures. The failures are frequent enough to be noticed by us and also our customers that manage to access our network after a few failed attempts. Here is our proxy.conf: proxy server { synchronous = yes retry_delay = 0 retry_count = 0 dead_time = 30 default_fallback = yes post_proxy_authorize = no } ####################################################################### # # Configuration for the proxy realms. realm NULL { type = radius ... nostrip } # # This realm is for ALL OTHER requests. # realm DEFAULT { type = radius ... nostrip } Any suggestions/ideas are highly welcome. I will audit the server's code to get a good idea of how it works but it will take me some time (I know just enough to develop a module for now). If you need anything that can trace the issue please let me know. Thanks in advance, Kostas

4 7

Protect Attribute from external rewriting!
by Erling Paulsen 26 Feb '07

26 Feb '07

I'm hoping someone can help me with the following problem: Some of our users gets proxied to external home-servers. We assign them to a wireless Vlan (guest-vlan) via rewriting the 'Tunnel-Private-Group-Id:0 := "xx"' Attribute. Is there a convenient way of safeguarding/checking this attribute in the reply message, so that it has not been rewritten externally and thus giving users access to restricted Vlans? I'm guessing it has something to do with the 'post-proxy' section, but I'm kindof blanc to what must be done - so I would appreciate any hints to get me started! - Erling Paulsen

2 1

Radclient.c hack for ntlm_auth testing
by Dow, Corey 26 Feb '07

26 Feb '07

Hi All, Is there any way to get radclient working with chap and ntlm_auth? If I try to use it with ntlm_auth, I get an Accept even with a bad password. redhatfc5:/etc/raddb # rt /tmp/file Sending Access-Request of id 15 to 127.0.0.1 port 1812 User-Name = "codo" CHAP-Password = 0x0f25a253a1113c6f903f31ec0d8eb7fae9 NAS-IP-Address = 180.44.200.10 NAS-Port-Type = Ethernet NAS-Port = 1 Calling-Station-Id = "000100000001" rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=15, length=61 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "103" HP-port-priority-regeneration-table = "0" Total approved auths: 1 Total denied auths: 0 Total lost auths: 0 redhatfc5:/etc/raddb # grep codo users codo Auth-Type := ntlm_auth redhatfc5:/etc/raddb # radtest codo badpass 127.0.0.1 1 hpsecret Sending Access-Request of id 144 to 127.0.0.1 port 1812 User-Name = "codo" User-Password = "badpass" NAS-IP-Address = 255.255.255.255 NAS-Port = 1 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=144, length=35 The radiusd debug output shows: auth: type "ntlm_auth" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 radius_xlat: Running registered xlat function of module mschap for string 'User-Name' radius_xlat: '/usr/bin/ntlm_auth ntlm_auth --request-nt-key --domain=NETIDM --username=codo --password=' Exec-Program: /usr/bin/ntlm_auth ntlm_auth --request-nt-key --domain=NETIDM --username=codo --password= modcall[authenticate]: module "ntlm_auth" returns ok for request 0 modcall: leaving group authenticate (returns ok) for request 0 Login OK: [codo/<CHAP-Password>] (from client me port 1 cli 000100000001) Processing the post-auth section of radiusd.conf I saw Alan's blog that states this isn't currently available but I was wondering if there was a way around it. Thanks ! Corey Corey Dow Solution Test Center Engineer ProCurve Networking Hewlett-Packard Company

2 1

[UPDATE] FreeRADIUS + LVS problem
by Sam Schultz 26 Feb '07

26 Feb '07

> According to my research, FreeRADIUS supposedly does work from behind > an LVS load balancer. My current configuration works perfectly > outside of the LVS, but once it is put behind the LVS it ceases > to work. Connections seem to succeed even behind the LVS, until > they get to an access challenge, where I get: > > rad_recv: Access-Challenge packet from host 192.168.240.111:5058, > id=42, length=64 Authentication reply packet code 11 sent to a non- > proxy reply port from client WPA_Test:5058 - ID 42 : IGNORED This was actually due to a buggy 3com access point. The real problem seems to have something to do with the way NAT interacts with radius. The Access-Request packets arrive at the backend server just fine: rad_recv: Access-Request packet from host 192.168.240.172:1031, id=0, length=209 Sending duplicate reply to client WPA_Test2.med-web.com:1031 - ID: 0 Re-sending Access-Challenge of id 0 to 192.168.240.172 port 1031 The AP's log doesn't show any indications of receiving them, so it would appear the problem is in the LVS/NAT, and probably doesn't have anything to do with the radius configuration. Feel free to call me out on this if you have an alternative explanation. -- Click for free info on online masters degrees and make $150K/ year http://tagline.hushmail.com/fc/CAaCXv1S74peFBJxEXqfDuyjOXwTvFQZ/

2 1

Re: radeapclient error !
by Amin BEN ABDALLAH 26 Feb '07

26 Feb '07

On Fri, 23 Feb 2007 11:08:16 +0100, Alan DeKok wrote > Amin BEN ABDALLAH wrote: > > *I used radeapclient to test authentification with EAP-MD5* > ... > > *I got an error in radeapclient :* > > > > *** glibc detected *** radeapclient: munmap_chunk(): invalid pointer: > > It's a bug. 1.1.5 will contain the fix. > > Alan DeKok. > -- > http://deployingradius.com - The web site of the book > http://deployingradius.com/blog/ - The blog > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Using FreeRadius 1.1.4, how can I test EAP-MD5 in FreeRadius ? is that possible using radeapclient ?

2 1

LDAP authentication allowed if User Object does not exist.
by Eric Belcher 25 Feb '07

25 Feb '07

Hi, I'm using freeradius on a SUSE 10 server. I'm using it to authenticate WPA2 wireless clients to Novell eDirectory. There is a twofold process. Being a school security is quite an issue. Each student is issued with a certificate that is used to authenticate him to the radius server. The certificate name is his MAC address. A corresponding NDS account exists for this MAC address. So, if the student installs his certificate and has an account in NDS, he is authenticated and the wireless access point allows an IP address to be obtained and the student has access. Using the NDS account I can limit the students access by changing the parameters of his MAC account. ie, allowed times. THIS IS ALL WORKING WELL. However, I have found a flaw I can't seem to find an answer for. I'm hoping someone can help. If the NDS account does not exist, as long as the SSL certificate is not revoked and is in the Freeradius database, the student will gain access. The radius server, does a lookup, can't find the account and just continues on. I need the radius server to reject access is an missing attribute causing a rejection if the account can't be found. Can anyone tell me how I can do this? Thanks Eric Belcher Eric Belcher Manager - Technology Services Anglican Church Grammar School Oaklands Parade, East Brisbane Eric.Belcher(a)acgs.qld.edu.au Phone 617 3896 2186 Fax 617 3891 5976 Disclaimer This email is intended for the use of the named individual or entity and may contain confidential and privileged information. Any dissemination distribution or copying by anyone other than the intended recipient of this email is strictly prohibited. If this email has been received in error, please send an email in response, or telephone us immediately on +61 7 38962200, and destroy the original message. Any views expressed in this message are those of the individual sender, except where the sender specifically states them to be the views of the Corporation of the Synod of the Diocese of Brisbane or Churchie.

2 2

Wait period between sessions
by Cory Robson 25 Feb '07

25 Feb '07

I have asked this question before without result so thought I'd re-ask with additional clarification. I have a user group that is only allowed 3hr session times (easily resolved with sql counter module) with a 15 minute wait period between sessions. Has anyone written a module or know of a way to implement this wait period. I was thinking something similar to a module based around the sql max session module only query the sql backend for the last time connected and if the period is less than set variable (15 mins in my case) then reject access with an error message like "Wait Period Enforced" Regards Cory Robson

8 13

No db files for default main_ippool
by Graeme Crawford 25 Feb '07

25 Feb '07

Hi im wondering why my two db files listed in the main_ippool do not exist the files are db.ippool and i think db.index, is there any way to create these files? thanks graeme

2 1

Re: PAM_RADIUS
by jerrrry＠voila.fr 23 Feb '07

23 Feb '07

OK authentication works but not accounting whereas i have in etc/pam.d/system-auth : account sufficient /lib/security/$ISA/pam_radius_auth.so any idea why my REDHAT does not send any accounting ? Thomas > Message du 23/02/07 à 17h39 > De : "jerrrry(a)voila.fr" > A : freeradius-users(a)lists.freeradius.org > Copie à : > Objet : PAM_RADIUS > > > Hi, > I'd like to know if FreeRadius Pam_RADIUS is still up to date ? > Do you have any suggest to make it work with Red Hat Entreprise Linux 4 ? > > Thanks, > Thomas > > [ (pas de nom de fichier) (0.1 Ko) ]

1 0

PAM_RADIUS
by jerrrry＠voila.fr 23 Feb '07

23 Feb '07

Hi, I'd like to know if FreeRadius Pam_RADIUS is still up to date ? Do you have any suggest to make it work with Red Hat Entreprise Linux 4 ? Thanks, Thomas

1 0