- Freeradius-Users - lists.freeradius.org

clean stale sessions with radzap?
by YvesDM 23 Sep '06

23 Sep '06

I use FR + mysql I try to clean some stale sessions from NAS's with dynamic ip's. I 'm logged in on the server and use radzap this way: radius1:~# radzap Usage: radzap [options] server[:port] secret So i try: radius1:~# radzap -u john localhost:1812 mysecret But this doesn't seem to be the right way? tnx yves

1 0

RE: Authentication against Active Directory page
by Jonathan De Graeve 23 Sep '06

23 Sep '06

Indeed, in my own tests I had to setup a kerberos realm and recompile the standard debian packages with the extra --with-ads rule. Does somebody know when machine authentication is supported in samba and if there is a patch for the 3.0.14 (debian stable) version? Kind Regards, J. -- Jonathan De Graeve Network/System Engineer Imelda vzw Informatica Dienst 015/50.52.98 Jonathan.de.graeve(a)imelda.be > -----Oorspronkelijk bericht----- > Van: freeradius-users- > bounces+jonathan.de.graeve=imelda.be(a)lists.freeradius.org > [mailto:freeradius-users- > bounces+jonathan.de.graeve=imelda.be(a)lists.freeradius.org] Namens King, > Michael > Verzonden: zaterdag 23 september 2006 4:47 > Aan: FreeRadius users mailing list > Onderwerp: RE: Authentication against Active Directory page > > Alan, > > What domain were you testing against? 2000 or 2003? (I ask, because I > was under the impression that KRB5 had to be setup as well) > > -----Original Message----- > From: freeradius-users-bounces+mking=bridgew.edu(a)lists.freeradius.org > [mailto:freeradius-users-bounces+mking=bridgew.edu@lists.freeradius.org] > On Behalf Of Alan DeKok > Sent: Friday, September 22, 2006 3:26 PM > To: FreeRadius users mailing list > Subject: Authentication against Active Directory page > > http://deployingradius.com/documents/configuration/active_directory.html > > It describes a minimal set of steps to take to get authentication > working against Active Directory. It works in my limited tests, but if > anyone runs into problems, please email me, and I'll update the page. > > Alan DeKok. > -- > http://deployingradius.com - The web site of the book > http://deployingradius.com/blog/ - The blog > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

2 1

debug for sqlippool
by Guilherme Franco 22 Sep '06

22 Sep '06

Hello! I've created a new sqlippool.conf customized for Oracle. The queries in there returns no error but I get this: modcall: entering group post-auth for request 0 Value Of the Pool-Name is [FOO] and its [3] Chars rlm_sql (sql): Reserving sql socket id: 2 radius_xlat: 'BEGIN' BEGIN rlm_sql_oracle: execute query failed in sql_query: ORA-06550: line 1, column 5: PLS-00103: Encountered the symbol "end-of-file" when expecting one of the following: begin case declare exit for goto if loop mod null pragma raise return select update while with <an identifier> <a double-quoted delimited-identifier> <a bind variable> << close current delete fetch lock insert open rollback savepoint set sql execute commit forall merge pipe rlm_sql_oracle: OCI_SERVER_NORMAL sqlippool_command: database query error radius_xlat: 'UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', expiry_time = current_timestamp - interval '1' second(1) WHERE pool_key = '845414518'' UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', expiry_time = current_timestamp - interval '1' second(1) WHERE pool_key = '845414518' radius_xlat: 'SELECT framedipaddress FROM radippool WHERE pool_name = 'SPW' AND expiry_time < current_timestamp AND ROWNUM = 1 ORDER BY (select username from radippool where username <> ''), (select callingstationid from radippool where callingstationid <> '#BRAS-01#this is a description#100#118'), expiry_time FOR UPDATE' SELECT framedipaddress FROM radippool WHERE pool_name = 'SPW' AND expiry_time < current_timestamp AND ROWNUM = 1 ORDER BY (select username from radippool where username <> ''), (select callingstationid from radippool where callingstationid <> '#BRAS-01#this is a description#100#118'), expiry_time FOR UPDATE So, radiusd -X just stops there (it does not quit), without any more messages (resulting in a time out for the BRAS). I know that the only place a BEGIN instance exists is in rlm_sqlippool.c. Even with sql_trace = yes, I can't see from where this error (ORA-06550: line 1, column 5: ) is coming from. As a result I don't know what is in line 1, column 5 to fix it. Any tips? After all this help you guys deserve to drink some beer here in Brazil :) Thanks a lot!

1 0

radius configuration error ?
by Federico Wenner 22 Sep '06

22 Sep '06

Hi friends, I am awfully worried about my radius configuration getting the following error. Could anybody help me with this real mess ? I can not find any hint in the freeradius.org/faq files. Version FreeRadius 1.0.5 MySQL 4.1.12 ERROR: rlm_sql (sql): No matching entry in the database for request from user [monkey] rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns notfound for request 0 modcall: group authorize returns ok for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejectin g the user auth: Failed to validate the user. Thanks and regards Federico.

1 0

No matching entry in the database
by Federico Wenner 22 Sep '06

22 Sep '06

Hi friends, I am awfully worried about my radius configuration getting the following error. Could anybody help me with this real mess ? ERROR: rlm_sql (sql): No matching entry in the database for request from user [monkey] rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns notfound for request 0 modcall: group authorize returns ok for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejectin g the user auth: Failed to validate the user. Thanks and regards Federico.

2 1

FW: Conditionally adding reply pair
by Garber, Neal 22 Sep '06

22 Sep '06

> You should be able to do this through the users file: >... > Just change the check and reply items where necessary. > If you don't expect to use the NetSensory huntgroup after > these lines, you may want to add the following after all > users file entries related to the NetSensory huntrgroup. Looking at the code for the files module, it appears that it is comparing check pairs against the request. Since the LDAP-Group is in the list of check pairs as opposed to the list of request pairs, I don't think this will work. In other words, I believe your example will look in the request pairs for attribute LDAP-Group and it won't be found. Can someone confirm or deny my analysis?

6 5

OpenSSL vulnerability may affect FreeRADIUS
by Alan DeKok 22 Sep '06

22 Sep '06

http://www.openssl.org/news/secadv_20060905.txt From my preliminary reading, this may only affect people using EAP-TLS. PEAP and EAP-TTLS do not validate certificates on the server side, so they may not be vulnerable. Still, it's probably worth upgrading OpenSSL. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog

1 0

automated response
by Olaf Becker 22 Sep '06

22 Sep '06

I am not in the office until 4th of Octorber 2006 and have limited access to my e-mails. Thank you for your understanding that your e-mail will be answered after my return to the office. This e-mail will not be forwarded. Kind regards Olaf Becker

1 0

Hiding Passwords in Debug Output
by Garber, Neal 22 Sep '06

22 Sep '06

I understand that it is sometimes useful to display the plain-text password in the debug output; however, I consider this a security exposure. I'd like to see a configuration option (e.g., debug_show_passwords or something similar) with a default of no, that when set to false/no would write "********" instead of a plain-text password in debug output. Currently, modules rlm_ldap, rlm_pap, and perhaps others write the plain-text password in debug output. Your thoughts? Neal

3 2

EAP-Problem
by Florian Prester 22 Sep '06

22 Sep '06

Hi, firstly, we are using Freeradius for all kind of authentications - and It works very good!! -> Good Job to all of you. But, lately we have some EAP-Problems mostly with windows-clients. If a user authenticated correctly, after some time he gets disconnected and tries to reauthenticate, but it fails - see Log. Also I have some questions about eap at all. How should it work correctly. because I see up to 10 Authentication-Requests until the client is authenticated correctly. For example the client wants to do EAP-PEAP (Windows-client), but the radius says EAP-NAK: rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: EAP-NAK asked for EAP-Type/peap rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 231 modcall: leaving group authenticate (returns handled) for request 231 Sending Access-Challenge ... Finished request 231 What does it mean? Can I tune the process? Thank you all for your answers! Best regards FLorian Prester Log: rad_recv: Access-Request packet from host 131.188.4.190:20000, id=35, length=202 NAS-Port-Id = "2059/1" Calling-Station-Id = "00-15-00-01-C0-D1" Called-Station-Id = "00-0B-0E-15-3D-80:FAU-STAFF" Service-Type = Framed-User User-Name = "unrz06" State = 0x... EAP-Message = 0x... NAS-Port-Type = Wireless-802.11 NAS-Identifier = "Trapeze" NAS-IP-Address = 131.188.4.190 Message-Authenticator = 0x... Processing the authorize section of radiusd.conf modcall: entering group authorize for request 228 modcall[authorize]: module "preprocess" returns ok for request 228 modcall[authorize]: module "chap" returns noop for request 228 modcall[authorize]: module "mschap" returns noop for request 228 rlm_eap: EAP packet type response id 14 length 53 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 228 users: Matched entry DEFAULT at line 12 modcall[authorize]: module "files" returns ok for request 228 rlm_ldap: - authorize modcall[authorize]: module "ldap" returns ok for request 228 modcall[authorize]: module "perl" returns ok for request 228 modcall: leaving group authorize (returns updated) for request 228 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 228 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A (other): SSL negotiation finished successfully rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) SSL Connection Established rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 228 modcall: leaving group authenticate (returns reject) for request 228 auth: Failed to validate the user. Login incorrect: [unrz06] (from client QRA-MX port 0 cli 00-15-00-01-C0-D1) Sending Access-Reject of id 35 to 131.188.4.190 port 20000 EAP-Message = 0x040e0004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 228 -- Dipl. Inf. Florian Prester Network Administration Regionales RechenZentrum Erlangen Universitaet Erlangen-Nuernberg Martensstr. 1 91052 Erlangen Germany Tel.: +499131 8527813

2 3