- Freeradius-Users - lists.freeradius.org

Number of requests from given client
by Pshem Kowalczyk 20 Feb '07

20 Feb '07

Hi, We run a farm of radius proxies for many different customers (wholesale of services), our devices send requests to the proxies, which in turn send them to the proper backend systems. Number of requests doesn't usually exceed 40-60 a sec, however if one of the client devices gets restarted (or simply crashes) the limit of requests (8192) gets depleted very quickly and proxies start dropping requests from all of the clients, sometimes the backend system of given customer gets overwhelmed which causes additional problems. Is there a way of setting the number of requests on per-client basis, so a single device can't use up whole pool? Of course I can increase the total number of request even further but that only postpones the problem. kind regards pshem

2 3

Fw: Attribute Max-Daily-Session + Session-Timeout
by Abel Monzón 20 Feb '07

20 Feb '07

No body know what is the solution? I send this e-mail, and nothing of answer. Good Day From: Abel Monzón To: mailist Sent: Monday, February 19, 2007 2:04 AM Subject: Attribute Max-Daily-Session + Session-Timeout Hello List. I have a problem. I had limited the Max-Daily-Session = 120, and the Session-Timeout = 60. The Session-Timeout work, but the Max-Daily-Session don't. because the Session-Timeout log out the user, but de Max-Daily-Session don't and let log in again. I have this in my radiusd.conf: sqlcounter contdiario { counter-name = Daily-Session-Time check-name = Max-Daily-Session sqlmod-inst = sql key = User-Name reset = daily count-attribute = Max-Daily-Session query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } authorize { .... contdiario ..... } Any help? Thanks

2 3

EAP-MD5 test
by Amin BEN ABDALLAH 20 Feb '07

20 Feb '07

I am a new user of Radius Server and I want to know how to test the authentification of an EAP-MD5 user using radtest, radclient or radeapclient. users file : ___________________________________________________________________ ali Auth-Type := EAP, User-Password == "ali" Reply-Message = "success" ___________________________________________________________________ The test : ___________________________________________________________________ echo "User-Name = ali, EAP-MD5-Password = ali" | radeapclient 127.0.0.1 auth testing123 ___________________________________________________________________ the result of the test is Access-Reject ___________________________________________________________________ Sending Access-Reject of id 133 to 127.0.0.1 port 32905 Reply-Message = "success" ___________________________________________________________________ Thanks in advance Amin BEN ABDALLAH

3 2

1.1.4 - TTLS - missing attributes
by Bjarni Hardarson 20 Feb '07

20 Feb '07

Hi list! Recently upgraded from 1.1.3 to 1.1.4 to support EAP-PEAP for Windows Vista clients. That works fine but now I got problems with missing reply attributes for Mac OSX clients using EAP-TTLS. FreeRADIUS sends an Access-Challenge with the correct attributes but they are missing from the final Access-Accept. If I use eapol_test client it works fine. I used the freeradius.spec file for Suse to build the server. The file is for 1.1.3. I simply changed the version number to 1.1.4. Here is the debug output from OSX. -------------- modcall: leaving group post-auth (returns ok) for request 5 TTLS: Got tunneled reply RADIUS code 2 User-Name = "XXXXXXX" Tunnel-Private-Group-Id:0 = "315" Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN MS-CHAP2-Success = 0xe9533d34313632353645463239384442354536433344363845364130414132374337423333373433324531 MS-MPPE-Recv-Key = 0x2f1c2a0924281f7543ac01a62e5d4959 MS-MPPE-Send-Key = 0x54b7f78adaa581dcbe24933210de2944 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 TTLS: Got tunneled Access-Accept TTLS: Got MS-CHAP2-Success, tunneling it to the client in a challenge. modcall[authenticate]: module "eap" returns handled for request 5 modcall: leaving group authenticate (returns handled) for request 5 Sending Access-Challenge of id 57 to 172.20.16.14 port 1645 User-Name = "XXXXXXX" Tunnel-Private-Group-Id:0 = "315" Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN MS-MPPE-Recv-Key = 0x2f1c2a0924281f7543ac01a62e5d4959 MS-MPPE-Send-Key = 0x54b7f78adaa581dcbe24933210de2944 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 EAP-Message = 0x0140005f15800000005517030100501cc3ec5991b8db1c9fa0b2a8738e13a3adafa3d12aad4719582298263fd36dd9e40a95a7b92783655681e701373871336737a7ea70a9a07ea8a015dc51b734e3700b71dc22b33bc6686f23efc7bfeba8 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd1d25d75fcc645729434631403c3dd5a Finished request 5 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 172.20.16.14:1645, id=58, length=142 NAS-IP-Address = 172.20.16.14 NAS-Port = 50632 NAS-Port-Type = Ethernet User-Name = "XXXXXXX" Called-Station-Id = "00-03-6B-BE-25-8F" Calling-Station-Id = "00-14-51-2E-6C-50" Service-Type = Framed-User Framed-MTU = 1500 State = 0xd1d25d75fcc645729434631403c3dd5a EAP-Message = 0x024000061500 Message-Authenticator = 0x2d5e6aadce0ad3a0eb864bc26e9271f9 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 rlm_realm: No '@' in User-Name = "XXXXXXX", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 64 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 modcall[authorize]: module "mschap" returns noop for request 6 modcall[authorize]: module "files" returns notfound for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 6 modcall: leaving group authenticate (returns ok) for request 6 Login OK: [XXXXXXX/<no User-Password attribute>] (from client SITEALAN port 50632 cli 00-14-51-2E-6C-50) Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 6 modcall[post-auth]: module "LDAP1LAN" returns noop for request 6 modcall[post-auth]: module "LDAP2LAN" returns noop for request 6 modcall[post-auth]: module "LDAP1AIR" returns noop for request 6 modcall[post-auth]: module "LDAP2AIR" returns noop for request 6 modcall[post-auth]: module "LDAP1VPN" returns noop for request 6 modcall[post-auth]: module "LDAP2VPN" returns noop for request 6 modcall: leaving group post-auth (returns noop) for request 6 Sending Access-Accept of id 58 to 172.20.16.14 port 1645 MS-MPPE-Recv-Key = 0x3e5ac1123d8312388fd89060503bbc0111586573e9b05e0166f4b738ef11db5a MS-MPPE-Send-Key = 0x68dce1376add4161d31704257ac1d5d9e891b1905e62064647c2216b53454986 EAP-Message = 0x03400004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "XXXXXXX" Finished request 6 ----------------------- Here is the debug output from eapol_test. -------------- modcall: leaving group post-auth (returns ok) for request 5 TTLS: Got tunneled reply RADIUS code 2 User-Name = "XXXXXXX" Tunnel-Private-Group-Id:0 = "328" Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN MS-CHAP-MPPE-Keys = 0x79b109dec67d52c6b969bc2f0b8a40a4f2df16f387f6ee980000000000000000 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 TTLS: Got tunneled Access-Accept rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 5 modcall: leaving group authenticate (returns ok) for request 5 Login OK: [anon/<no User-Password attribute>] (from client localhost port 0 cli 00-00-00-00-00-02) Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 5 modcall[post-auth]: module "LDAP1LAN" returns noop for request 5 modcall[post-auth]: module "LDAP2LAN" returns noop for request 5 modcall[post-auth]: module "LDAP1AIR" returns noop for request 5 modcall[post-auth]: module "LDAP2AIR" returns noop for request 5 modcall[post-auth]: module "LDAP1VPN" returns noop for request 5 modcall[post-auth]: module "LDAP2VPN" returns noop for request 5 modcall: leaving group post-auth (returns noop) for request 5 Sending Access-Accept of id 5 to 127.0.0.1 port 32777 User-Name = "XXXXXXX" Tunnel-Private-Group-Id:0 = "328" Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN MS-CHAP-MPPE-Keys = 0x79b109dec67d52c6b969bc2f0b8a40a4f2df16f387f6ee980000000000000000 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 MS-MPPE-Recv-Key = 0xa74558be21dd80fe6f406921c6e2aa367e840ac12405c4ab86adf7fa48c4effa MS-MPPE-Send-Key = 0x9901fdcc0f86e0091f1a16795ff2a480b99d28b46094b557cae32f81bb4b16e2 EAP-Message = 0x03050004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 5 ------------------- /etc/raddb/eap.conf -------------- eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no tls { private_key_password = *************** private_key_file = ${raddbdir}/certs/server_key.pem certificate_file = ${raddbdir}/certs/server_cert.pem CA_file = ${raddbdir}/certs/rootcert.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random } ttls { default_eap_type = mschapv2 use_tunneled_reply = yes copy_request_to_tunnel = yes } mschapv2 { } peap { default_eap_type = mschapv2 use_tunneled_reply = yes copy_request_to_tunnel = yes } mschapv2 { } } -------------- /etc/raddb/users -------------- DEFAULT FreeRADIUS-Proxied-To == 127.0.0.1 User-Name = "%{User-Name}", Fall-Through = Yes DEFAULT Huntgroup-name == "LAN", FreeRADIUS-Proxied-To == 127.0.0.1, Autz-Type := LAN DEFAULT Huntgroup-name == "AIR", FreeRADIUS-Proxied-To == 127.0.0.1, Autz-Type := AIR DEFAULT Huntgroup-Name == "VPN", Autz-Type := VPN, Auth-Type := Local -------------- regards/mvh Bjarni Hardarson

6 14

Re: The EAP Saga begins.
by Evan Vittitow 20 Feb '07

20 Feb '07

[CONFIG] Socket 4 (frame handler) had an event! Network ID from EAP hint : Pukey If this is a wired network, the above ID can be used in the configuration file to identify this network. [CONFIG] Working from config file /etc/xsupplicant.conf. Network ID from EAP hint : Pukey If this is a wired network, the above ID can be used in the configuration file to identify this network. [CONFIG] Working from config file /etc/xsupplicant.conf. [CONFIG] Identity : User [CONFIG] Socket 4 (frame handler) had an event! [CONFIG] Trying to load root certificate /etc/raddb/certs/cert-clt.pem or certificate directory (null) [CONFIG] Loaded root certificate /etc/raddb/certs/cert-clt.pem and directory (null) [CONFIG] Socket 4 (frame handler) had an event! OpenSSL Error -- error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed This is xsupplicant's output. ukey { type = wireless allow_types = eap_peap identity = User eap-peap { random_file = /dev/urandom root_cert = /etc/raddb/certs/cert-clt.pem chunk_size = 1398 allow_types = eap_mschapv2 eap-mschapv2 { username = User password = password } } } I changed the Username and password.

4 20

freeradius 1.1.4 + LDAP + PEAP/mschapv2
by Baptiste Delporte 19 Feb '07

19 Feb '07

Hi all ! After installing Freeradius 1.1.4, I am trying to set it up to authenticate users with a LDAP database using PEAP + eap/mschapv2. Freeradius seems to work fine for most users, but for a few people I get this error in my log file : /Mon Feb 19 09:30:07 2007 : Info: rlm_eap_tls: Length Included Mon Feb 19 09:30:07 2007 : Error: TLS_accept:error in SSLv3 read client certificate A Mon Feb 19 09:30:07 2007 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Mon Feb 19 09:30:07 2007 : Info: rlm_eap_tls: Received EAP-TLS ACK message Mon Feb 19 09:30:07 2007 : Info: rlm_eap_tls: Length Included Mon Feb 19 09:30:07 2007 : Info: (other): SSL negotiation finished successfully Mon Feb 19 09:30:07 2007 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Mon Feb 19 09:30:07 2007 : Info: rlm_eap_tls: Received EAP-TLS ACK message Mon Feb 19 09:30:07 2007 : Info: rlm_eap_mschapv2: Issuing Challenge Mon Feb 19 09:30:08 2007 : Error: rlm_mschap: Invalid LM-Password Mon Feb 19 09:30:08 2007 : Error: rlm_mschap: Invalid NT-Password Mon Feb 19 09:30:08 2007 : Auth: Login incorrect: [********] /Authentication works perfectly with the same config files (eap.conf, radiusd.conf,users...) with an older version (1.0.1 and even 1.1.3) of freeradius on the same server. I've made tests with EAP-TTLS, and in that case authentication also works fine for everyone. In both cases, I get this line when I run freeradius in debug mode : /rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. /And I can't find if there's a link between that warning and the authentication failure for some of my users. Thanks for your help. -- Ce message a été vérifié par MailScanner pour des virus ou des polluriels et rien de suspect n'a été trouvé. MailScanner remercie transtec pour son soutien.

2 1

FreeRadius + MySQL - Crypt-Passwrd in radcheck table
by Nataniel Klug 19 Feb '07

19 Feb '07

Hello people, I am using freeradius-1.0.1-3.RHEL4.3 and freeradius-mysql-1.0.1-3.RHEL4.3 on a CentOS 4.4 server but I am sutcked into a problem. I have made my FreeRadius works great using MySQL but I could not make it uses Crypt-Password. Into radcheck table I have: mysql> SELECT * FROM radcheck; +----+----------+----------------+----+----------------------------------+ | id | UserName | Attribute | op | Value | +----+----------+----------------+----+----------------------------------+ | 1 | teste | Crypt-Password | == | 42cbf4730aeac1d645324d4818104826 | +----+----------+----------------+----+----------------------------------+ 1 row in set (0.00 sec) The password was encrypted using PHP MD5 command and should be 8872. But when I use a radtest command the respose of my Radius is: Sun Feb 18 17:23:56 2007 : Auth: Login incorrect: [teste/8872] (from client localhost port 1812) I made the same in debug mode and radius just not get the password. I think it is not testing the 8872 password to see if it matches de MD5 crypt. I tryed with "42cbf4730aeac1d645324d4818104826" as a password and it returned OK for the request. How can I do this work? I need that into MySQL table I have a crypted password (for security reasons) and I need that my clients can put a simple text password. Can someone give me a hit? -- Att, NATANIEL KLUG nata(a)cnett.com.br Cyber Nett - Internet Banda Larga www.cnett.com.br (42) 3635-2957 Rua Diogo Pinto, 1046, Centro Laranjeiras do Sul - PR Brasil - 85301-290

2 3

radwho is not working
by Angel L. Mateo 19 Feb '07

19 Feb '07

Hello, I have a problem with radwho and it is not working, it shows an empty list of users. I have two freeradius servers with the same configuration (running in an active/standby configuration). I have configure unix (radwtmp) and radutmp modules, I have configure accounting to use both unix and radutmp modules and session to use radutmp. I have also configure sql_log module so both servers logs accounting information to a share backend. So my configuration is: modules { ... # Unix /etc/passwd style authentication # unix { cache = no cache_reload = 600 shadow = /etc/shadow radwtmp = ${logdir}/radwtmp } # Write a 'utmp' style file, of which users are currently # logged in, and where they've logged in from. # # This file is used mainly for Simultaneous-Use checking, # and also 'radwho', to see who's currently logged in. # radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } # # The rlm_sql_log module appends the SQL queries in a log # file which is read later by the radsqlrelay program. # # This module only performs the dynamic expansion of the # variables found in the SQL statements. No operation is # executed on the database server. (this could be done # later by an external program) That means the module is # useful only with non-"SELECT" statements. # # See rlm_sql_log(5) manpage. # sql_log { path = ${radacctdir}/sql-relay acct_table = "radacct" postauth_table = "radpostauth" Start = "INSERT INTO ${acct_table} (AcctSessionId, UserName, \ RealUserName, \ NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \ AcctSessionTime, AcctTerminateCause) VALUES \ ('%{Acct-Session-Id}', '%{User-Name}', \ '%{Class}', '%{NAS-IP-Address}', \ '%{Framed-IP-Address}', '%S', '0', '0', '');" Stop = "INSERT INTO ${acct_table} (AcctSessionId, UserName, \ RealUserName, \ NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \ AcctSessionTime, AcctTerminateCause) VALUES \ ('%{Acct-Session-Id}', '%{User-Name}', \ '%{Class}', '%{NAS-IP-Address}', \ '%{Framed-IP-Address}', '0', '%S', '%{Acct-Session-Time}', \ '%{Acct-Terminate-Cause}');" Alive = "INSERT INTO ${acct_table} (AcctSessionId, UserName, \ RealUserName, \ NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, \ AcctSessionTime, AcctTerminateCause) VALUES \ ('%{Acct-Session-Id}', '%{User-Name}', \ '%{Class}, '%{NAS-IP-Address}', \ '%{Framed-IP-Address}', '0', '0', '%{Acct-Session-Time}','');" Post-Auth = "INSERT INTO ${postauth_table} \ (user, pass, reply, date, ip) VALUES \ ('%{User-Name}', '%{User-Password:-Chap-Password}', \ '%{reply:Packet-Type}', '%S', '%{Client-IP-Address}' );" } } accounting { # # Accounting. Log the accounting data. # accounting { # # Create a 'detail'ed log of the packets. # Note that accounting requests which are proxied # are also logged in the detail file. detail # Update the wtmp file # # If you don't use "radlast", you can delete this line. unix # # For Simultaneous-Use tracking. # # Due to packet losses in the network, the data here # may be incorrect. There is little we can do about it. radutmp # Return an address to the IP Pool when we see a stop record. # amateo, 07/07/06: Activamos los pooles que hemos definido pool_vpn pool_vpn_alu pool_ono pool_ono_alu # # Instead of sending the query to the SQL server, # write it into a log file. # sql_log } session { radutmp } The problem I have is that although radumtp and radwmtp are updated every time time radius authenticate an user, radwho shows an empty list, but radlast shows information. For example, at this moment: vulpes2:/etc/freeradius# radlast | more anonymou 765:ap Thu Jan 4 12:06 still logged in skarmeta 810:ap Thu Jan 4 12:05 still logged in anonymou 939:ap Thu Jan 4 12:05 - 12:06 (00:00) anonymou 1648:ap Thu Jan 4 12:05 still logged in anonymou 1211:ap Thu Jan 4 12:03 still logged in anonymou 1647:ap Thu Jan 4 12:02 - 12:05 (00:03) anonymou 764:ap Thu Jan 4 12:02 - 12:05 (00:03) skarmeta 837:ap Thu Jan 4 12:01 - 12:05 (00:03) anonymou 938:ap Thu Jan 4 12:00 - 12:02 (00:01) anonymou 1646:ap Thu Jan 4 11:59 - 12:02 (00:03) anonymou 763:ap Thu Jan 4 11:58 - 12:00 (00:01) skarmeta 809:ap Thu Jan 4 11:57 - 12:01 (00:03) anonymou 1645:ap Thu Jan 4 11:57 - 11:59 (00:02) anonymou 937:ap Thu Jan 4 11:56 - 11:58 (00:01) anonymou 613:ap Thu Jan 4 11:55 - 12:00 (00:04) anonymou 1644:ap Thu Jan 4 11:55 - 11:57 (00:02) anonymou 762:ap Thu Jan 4 11:54 - 11:56 (00:01) skarmeta 835:ap Thu Jan 4 11:53 - 11:57 (00:03) anonymou 1643:ap Thu Jan 4 11:53 - 11:55 (00:02) anonymou 1642:ap Thu Jan 4 11:51 - 11:53 (00:01) anonymou 936:ap Thu Jan 4 11:50 - 11:54 (00:03) anonymou 2668:ap Thu Jan 4 11:50 still logged in skarmeta 808:ap Thu Jan 4 11:49 - 11:53 (00:03) anonymou 1641:ap Thu Jan 4 11:49 - 11:51 (00:02) anonymou 761:ap Thu Jan 4 11:48 - 11:50 (00:01) ... as you can see, radlast shows that there are users logged in to teh system, but vulpes2:/etc/freeradius# radwho Login Name What TTY When From Location any idea? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información _o) y las Comunicaciones Aplicadas (ATICA) / \\ http://www.um.es/atica _(___V Tfo: 968367590 Fax: 968398337

5 11

RE: Installing Free radius 1.1.4 on Server Running Centos 4.4
by Josh Howlett 19 Feb '07

19 Feb '07

$ yum install freeradius Josh. > -----Original Message----- > From: > freeradius-users-bounces+j.howlett=ukerna.ac.uk(a)lists.freeradi > us.org > [mailto:freeradius-users-bounces+j.howlett=ukerna.ac.uk@lists. freeradius.org] On Behalf Of dataHosting Support > Sent: 19 February 2007 07:28 > To: freeradius-users(a)lists.freeradius.org > Subject: Installing Free radius 1.1.4 on Server Running Centos 4.4 > > > > Is there an easy step by step guide for beginners on > installing Free Radius 1.1.4. on Centos 4.4? > > > > Have setup new Centos Server and now wanting to install Free Radius. > > > > > > Regards, > > > > David Willis > > > > > >

1 0

Installing Free radius 1.1.4 on Server Running Centos 4.4
by dataHosting Support 19 Feb '07

19 Feb '07

Is there an easy step by step guide for beginners on installing Free Radius 1.1.4. on Centos 4.4? Have setup new Centos Server and now wanting to install Free Radius. Regards, David Willis

1 0