- Freeradius-Users - lists.freeradius.org

CVS: radtest strangeness
by Jan Mulders 19 Oct '06

19 Oct '06

Okay, I knew the CVS was weird, but this really takes the cake: root@betabitch [~]# radtest testuser1 testing localhost 5 SuperSecretPassword Unknown attribute "Password" radclient: cannot parse Password = "testing" What on earth? Usage: radtest user passwd radius-server nas-port-id secret [ppphint] [nasname] Have I really missed something obvious? Hopefully someone can clear this up real quick for me. Thanks, Jan

2 3

SSL_read failed in a system call
by King, Michael 18 Oct '06

18 Oct '06

I posted this to the list back in September, but was unable to chase it then. http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg294 52.html But it has returned with a vengeance. It only seems to affect the 1.1.3 server. I have not tried any other versions, other than the 1.0.4 I've listed below, which seems to work fine I think it's load related, since when I test with a few clients, it worked fine. When I dumped 1000 of clients, with over 50 auths/sec, things went horrible wrong. I found this on the net with the same error string: http://www.mail-archive.com/modssl-users@modssl.org/msg16180.html > There is definately something wrong in openssl 0.9.7a, or, mod_ssl 2.8.14 is trying > to call 0.9.6 functions which are different/don't exist in 0.9.7 And I found this: http://lists.alioth.debian.org/pipermail/pkg-openssl-devel/2005-November /000418.html Which has a link to: http://www.aet.tu-cottbus.de/rt2/Ticket/Display.html?id=1204 (OpenSSL's BugTracker?) >Use of SSL_OP_TLS_BLOCK_PADDING_BUG, which is included in SSL_OP_ALL, >triggers a bug in OpenSSL if both the client and server is using version 0.9.8. Unfortunately, I'm using 0.9.7 Here's my status I've built a new radius server. FreeRADIUS 1.1.3 Windbind using ntlm_auth to talk to ActiveDirectory. Mostly XP clients using the Built-in XP supplicant. (PEAP) Running on RedHat RHEL 4 Server has a trusted root Cert from Equifax. (I do NOT have a self-signed Cert) Server name is brand new, it has never been used in my network before OpenSSL is openssl-0.9.7a-43.11 via Up2date I got it all setup and operating correctly (based on my 1.0.4 config that's been in production for 1.5 years). Tested it with a few clients, everything looks fine. I put some major traffic on it, and everything goes downhill. :-( The logs read this (per user) Wed Oct 11 17:57:58 2006 : Error: TLS_accept:error in SSLv3 read client certificate A Wed Oct 11 17:57:58 2006 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Wed Oct 11 17:57:58 2006 : Error: TLS Alert write:fatal:bad record mac Wed Oct 11 17:57:58 2006 : Error: TLS_accept:error in SSLv3 read certificate verify A Wed Oct 11 17:57:58 2006 : Error: rlm_eap: SSL error error:1408F455:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac Wed Oct 11 17:57:58 2006 : Error: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. Wed Oct 11 17:57:58 2006 : Auth: Login incorrect: [BSC\\mking] (from client BUWiSM-1-2 port 29 cli 00-90-96-F4-2A-BB) For every single user. At the very beginning, a few users authenticate fine, nobody gets on after that. (All this in the first second of starting the server) So I move everyone back to my working server (version 1.0.4, OpenSSL is 0.9.7e-3 via debian) Now, it's still in this state. If I stop and start the server, it'll be normal again. Is there anykind of debugging info I can get you right now without killing the running process? I moved traffic to the server at: 17:54:03 I moved traffic off at: 17:54:36 As you can see above, I tried it with a test station at 17:57:58, and it was still busted. (Test station worked fine at 17:50) Also, I checked out the /var/log/messages file, it had this weirdness in it. I tried restarting winbindd a few seconds before these time stamps, so that's may be what threw all the error messages. Oct 11 17:02:42 radius1 kernel: audit(1160600562.652:20): avc: denied { search } for pid=2831 comm="winbindd" name="lib" dev=dm-0 ino=589826 scontext=user _u:system_r:winbind_t tcontext=system_u:object_r:var_lib_t tclass=dir Oct 11 17:02:42 radius1 kernel: audit(1160600562.652:21): avc: denied { getattr } for pid=2831 comm="winbindd" name="samba" dev=dm-0 ino=589961 scontext=u ser_u:system_r:winbind_t tcontext=system_u:object_r:var_lib_t tclass=dir Oct 11 17:57:44 radius1 winbind: winbindd shutdown succeeded Oct 11 17:57:46 radius1 kernel: audit(1160603866.541:22): avc: denied { setattr } for pid=4000 comm="winbindd" name="winbindd" dev=dm-0 ino=590836 scontex t=root:system_r:winbind_t tcontext=root:object_r:samba_log_t tclass=dir Oct 11 17:57:46 radius1 kernel: audit(1160603866.566:23): avc: denied { write } for pid=4000 comm="winbindd" name="secrets.tdb" dev=dm-0 ino=937186 sconte xt=root:system_r:winbind_t tcontext=root:object_r:samba_etc_t tclass=file Oct 11 17:57:46 radius1 kernel: audit(1160603866.566:24): avc: denied { search } for pid=4000 comm="winbindd" name="lib" dev=dm-0 ino=589826 scontext=root :system_r:winbind_t tcontext=system_u:object_r:var_lib_t tclass=dir Oct 11 17:57:46 radius1 kernel: audit(1160603866.566:25): avc: denied { read write } for pid=4000 comm="winbindd" name="gencache.tdb" dev=dm-0 ino=590838 scontext=root:system_r:winbind_t tcontext=root:object_r:var_lib_t tclass=file Oct 11 17:57:46 radius1 kernel: audit(1160603866.566:26): avc: denied { lock } for pid=4000 comm="winbindd" name="gencache.tdb" dev=dm-0 ino=590838 sconte xt=root:system_r:winbind_t tcontext=root:object_r:var_lib_t tclass=file Oct 11 17:57:46 radius1 kernel: audit(1160603866.566:27): avc: denied { getattr } for pid=4000 comm="winbindd" name="gencache.tdb" dev=dm-0 ino=590838 sco ntext=root:system_r:winbind_t tcontext=root:object_r:var_lib_t tclass=file Oct 11 17:57:46 radius1 kernel: audit(1160603866.566:28): avc: denied { getattr } for pid=4000 comm="winbindd" name="samba" dev=dm-0 ino=589961 scontext=r oot:system_r:winbind_t tcontext=system_u:object_r:var_lib_t tclass=dir Oct 11 17:57:46 radius1 kernel: audit(1160603866.568:29): avc: denied { getattr } for pid=4001 comm="winbindd" name="winbindd_privileged" dev=dm-0 ino=590 759 scontext=root:system_r:winbind_t tcontext=user_u:object_r:var_lib_t tclass=dir Oct 11 17:57:46 radius1 kernel: audit(1160603866.568:30): avc: denied { search } for pid=4001 comm="winbindd" name="winbindd_privileged" dev=dm-0 ino=5907 59 scontext=root:system_r:winbind_t tcontext=user_u:object_r:var_lib_t tclass=dir Oct 11 17:57:46 radius1 kernel: audit(1160603866.568:31): avc: denied { write } for pid=4001 comm="winbindd" name="winbindd_privileged" dev=dm-0 ino=59075 9 scontext=root:system_r:winbind_t tcontext=user_u:object_r:var_lib_t tclass=dir Oct 11 17:57:46 radius1 kernel: audit(1160603866.568:32): avc: denied { remove_name } for pid=4001 comm="winbindd" name="pipe" dev=dm-0 ino=590760 scontex t=root:system_r:winbind_t tcontext=user_u:object_r:var_lib_t tclass=dir Oct 11 17:57:46 radius1 kernel: audit(1160603866.568:33): avc: denied { unlink } for pid=4001 comm="winbindd" name="pipe" dev=dm-0 ino=590760 scontext=roo t:system_r:winbind_t tcontext=user_u:object_r:var_lib_t tclass=sock_file Oct 11 17:57:46 radius1 kernel: audit(1160603866.568:34): avc: denied { add_name } for pid=4001 comm="winbindd" name="pipe" scontext=root:system_r:winbind _t tcontext=user_u:object_r:var_lib_t tclass=dir Oct 11 17:57:46 radius1 kernel: audit(1160603866.568:35): avc: denied { create } for pid=4001 comm="winbindd" name="pipe" scontext=root:system_r:winbind_t tcontext=root:object_r:var_lib_t tclass=sock_file Oct 11 17:57:46 radius1 winbind: winbindd startup succeeded Oct 11 17:57:46 radius1 kernel: audit(1160603866.572:36): avc: denied { write } for pid=4002 comm="winbindd" name="krb5.conf" dev=dm-0 ino=934018 scontext =root:system_r:winbind_t tcontext=root:object_r:etc_t tclass=file Oct 11 17:57:46 radius1 kernel: audit(1160603866.600:37): avc: denied { read write } for pid=4002 comm="winbindd" name="winbindd_cache.tdb" dev=dm-0 ino=5 90761 scontext=root:system_r:winbind_t tcontext=user_u:object_r:var_lib_t tclass=file Oct 11 17:57:46 radius1 kernel: audit(1160603866.600:38): avc: denied { lock } for pid=4002 comm="winbindd" name="winbindd_cache.tdb" dev=dm-0 ino=590761 scontext=root:system_r:winbind_t tcontext=user_u:object_r:var_lib_t tclass=file Oct 11 17:57:46 radius1 kernel: audit(1160603866.600:39): avc: denied { getattr } for pid=4002 comm="winbindd" name="winbindd_cache.tdb" dev=dm-0 ino=5907 61 scontext=root:system_r:winbind_t tcontext=user_u:object_r:var_lib_t tclass=file

2 5

Freeradius error: invalid keyword "ATTRIB_NMC"
by Jan Mulders 18 Oct '06

18 Oct '06

Hi list. I'm having some problems getting the nightly CVS snapshot to work. It compiles fine, I've set relevant log directories, and gotten rid of the old dictionary files, instead using the ones in the CVS. I now get this error when attempting to start radiusd: Wed Oct 18 15:18:43 2006 : Error: Errors reading dictionary: dict_init: /usr/local/share/freeradius/dictionary.usr[56] invalid keyword "ATTRIB_NMC" The offending file contains the following: # # USR Extensions: USR Vendor-Specific stuff. # # For now in NMC format (whatever that stands for), though the # normal vendor-specific format would work just as well. # # ATTRIB_NMC USR-Last-Number-Dialed-Out 0x0066 string ATTRIB_NMC USR-Last-Number-Dialed-In-DNIS 0x00E8 string ATTRIB_NMC USR-Last-Callers-Number-ANI 0x00E9 string ATTRIB_NMC USR-Channel 0xBF38 integer ATTRIB_NMC USR-Event-Id 0xBFBE integer ATTRIB_NMC USR-Event-Date-Time 0xBF2F date ATTRIB_NMC USR-Call-Start-Date-Time 0xBFF7 date ATTRIB_NMC USR-Call-End-Date-Time 0xBFF6 date ATTRIB_NMC USR-Default-DTE-Data-Rate 0x005E integer ...and on and on. Is there something I need to do in order to get this to work? Have I made a silly mistake? Thanks all, Jan

2 1

Stress test for EAP-PEAP
by King, Michael 18 Oct '06

18 Oct '06

Since I've been having great amounts of troubles with 1.1.2 / 1.1.3, (See SSL_read failed in a system call message) We're going to try building another server with 1.0.4 (The latest version that we have in production that works for us) Anyone know of a stress test utility that can simulate EAP-PEAP? In my test labs, everything works great. It's only when I load a few hundred to a thousand clients that things seem to break. I'd like to find out if this new server is going to have issues before I impact my clients

2 1

Re: How to configure multi nas
by Peter Nixon 18 Oct '06

18 Oct '06

On Wed 18 Oct 2006 12:19, Enkhbat.N wrote: > Hi All > > > > I have those problems. Please help to solve the problems > > > > 1. How to configure many NASes on one RADIUS? > 2. How to setting user's connection NAS. > > Example Special users are connected on Primary NAS and other users are > connected on Secondary NAS. Please read the documentation (http://wiki.freeradius.org/ is a good place to start). If you still can't figure it out youself then ask for help on the users list.. NOT this list. Cheers -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc

1 0

FreeRADIUS user Survey
by Alan DeKok 18 Oct '06

18 Oct '06

In order to better understand the needs of people using FreeRADIUS, I've set up a survey with 12 questions. The goal is to understand who's using FreeRADIUS, how they're using it, and what the users needs are. The page is: http://gs-survey.com/s.asp?s=1651 Please take a few minutes to fill out the survey, and I'll be posting a summary of the responses here. I expect to have a few more surveys after this one, to be able to target future development. Thanks for your efforts in supporting FreeRADIUS. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog

9 14

Re: problem with proxy configuration
by Prabhdeep Singh 18 Oct '06

18 Oct '06

Hi Alan, Thanks for the response. > It looks like you've configured the server to proxy to itself. Why? > I do understand your technical objection of doing what I am doing, but I have a valid application reson, which is that I support multiple realms on this particular radius server. For some realms, I want the UserName to strip the Realm name ("nostrip") and for some I don't.... Is there any other way to achieve the same than not using "striop" and "nostrip" flag in proxy.conf Thanks again for your comments. Prabh -- MyBlog: http://things-on-my-mind.blogspot.com/ Get your news at www.DailyHeadlines.NET

3 3

Module detach function behavior
by Nicolas Castel 18 Oct '06

18 Oct '06

Hi all, I'd like to know the behavior of the detach module function. That is what happens when some threads are running and using an instance of a module and that the server must be stopped or reloaded ? Does FreeRADIUS waits for threads to terminate their job before calling the module detach function or are they killed before they have terminated ? Thanks

2 1

RE: cisco-accounting do not work. what i miss?
by Paloma Munoz 18 Oct '06

18 Oct '06

I answer my own question: There are not problem. This was my accounting port.

1 0

How to create my own module in Freeradius !!!
by Vineet.Asati＠t-systems.com 18 Oct '06

18 Oct '06

Hi Techies, I am a new bie to freeradius fraternity. So grasping lot of things from this mailing list ;) I want to write my own module (which have a .c file prints out "Hello World" to a file). Would any of you please tell me on how can i do this. What all configurations are required? I am using Freeradius-1.1.3 server version. Regards Vineet

3 2