- Freeradius-Users - lists.freeradius.org

ERROR! Proxy listen.c error
by Guilherme Franco 18 Sep '06

18 Sep '06

Hello, Using Proxy, when user mistypes the password, radiusd -X crashes with Assertion failed in listen.c, line 558!!!!!!!! Line 558 = rad_assert(request->listener == listener); Thanks.

2 3

VSA does not work when using PROXY
by Guilherme Franco 18 Sep '06

18 Sep '06

Hello, Please Help! Using latest CVS - Proxy-Radius does not pass the VSA, as below (in users): DEFAULT Pool-Name := test X-Ascend-Client-Primary-DNS = x.x.x.x, X-Ascend-Client-Assign-DNS = 1, ERX-Virtual-Router-Name = "default", Framed-Routing == None, Framed-Protocol = PPP, Service-Type = Framed-User note: those vsa works correctly when I try with local users (no proxy): In attrs file: realm Service-Type == Framed-User, Framed-Protocol == PPP, X-Ascend-Client-Primary-DNS == x.x.x.x, X-Ascend-Client-Assign-DNS == 1, ERX-Virtual-Router-Name == "default", Idle-Timeout <= 600, Session-Timeout <= 28800 Output: rad_recv: Access-Request packet from host x.x.x.x port 50000, id=55, length=251 User-Password = "xxx" User-Name = "xxx@realm" Acct-Session-Id = "erx atm 3/2.42:100.221:0009437817" Service-Type = Framed-User Framed-Protocol = PPP ERX-Pppoe-Description = "pppoe 12:34:56:78:9a:bc" Calling-Station-Id = "#BRAS-01#this is a description#100#221" Connect-Info = "speed:UBR:12000" NAS-Port-Type = xDSL NAS-Port = 845414621 NAS-Port-Id = "atm 3/2.42:100.221" NAS-IP-Address = x.x.x.x NAS-Identifier = "BRAS-01" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 rlm_realm: Looking up realm "realm" for User-Name = "xxx" rlm_realm: Found realm "realm" rlm_realm: Adding Stripped-User-Name = "xxx" rlm_realm: Proxying request from user xxx to realm realm rlm_realm: Adding Realm = "realm" rlm_realm: Preparing to proxy authentication request to realm "realm" rlm_eap: No EAP-Message, not doing EAP users: Matched entry DEFAULT at line 194 modcall: group authorize returns noop for request 0 Sending Access-Request of id 155 to x.x.x.x port 1645 User-Password = "xxx" User-Name = "xxx" Acct-Session-Id = "erx atm 3/2.42:100.221:0009437817" Service-Type = Framed-User Framed-Protocol = PPP ERX-Pppoe-Description = "pppoe 12:34:56:78:9a:bc" Calling-Station-Id = "#BRAS-01#this is a description#100#221" Connect-Info = "speed:UBR:12000" NAS-Port-Type = xDSL NAS-Port = 845414621 NAS-Port-Id = "atm 3/2.42:100.221" NAS-IP-Address = x.x.x.x NAS-Identifier = "BRAS-01" Proxy-State = 0x3535 --- Walking the entire request list --- Waking up in 1 seconds... rad_recv: Access-Accept packet from host x.x.x.x port 1645, id=155, length=60 Framed-IP-Address = 255.255.255.254 Framed-IP-Netmask = 255.255.255.255 Framed-MTU = 576 Service-Type = Framed-User Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP Proxy-State = 0x3535 Processing the post-proxy section of radiusd.conf modcall: entering group post-proxy for request 0 attr_filter: Matched entry realm at line 52 modcall: group post-proxy returns noop for request 0 authorize: Skipping authorize in post-proxy stage rad_check_password: Found Auth-Type rad_check_password: Auth-Type = Accept, accepting the user Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 0 radius_xlat: 'x.x.x.x 845414621' rlm_ippool: MD5 on 'key' directive maps to: 6e4d4f13b0396f83e15609738a3bc036 rlm_ippool: Searching for an entry for key: '6e4d4f13b0396f83e15609738a3bc036' rlm_ippool: Allocating ip to key: '6e4d4f13b0396f83e15609738a3bc036' rlm_ippool: num: 1 rlm_ippool: Allocated ip x.x.x.x to client key: 6e4d4f13b0396f83e15609738a3bc036 modcall: group post-auth returns ok for request 0 Sending Access-Accept of id 55 to x.x.x.x port 50000 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = x.x.x.x Framed-IP-Netmask = 255.255.255.255 Finished request 0 Going to the next request Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 55 with timestamp 450b0ba9 Nothing to do. Sleeping until we see a request. As you can see, The VSA was not included in the Access-Accept response. Please HELP! THANKS!

1 1

RE: Pattern Matching in users file
by Garber, Neal 18 Sep '06

18 Sep '06

> Which says you *can* use them. It doesn't say you *can'*t > use anything else. Thanks Alan. As always, I appreciate you taking the time to offer your insight. Currently, the Wiki, README and sample file only mention the example of testing username using prefix/suffix. If a more generic statement of purpose for hints existed, then I would have taken the information about username testing in the Wiki, the README and the sample file as just an example. I haven't found anything, other than your enlightening response to my question that describes the overall purpose of hints (i.e., that it can add request attributes based upon the value of an existing request attribute). Did I miss something?

2 1

Create-users.pl
by Nico Gazzano 18 Sep '06

18 Sep '06

I've used this script to generate a list of users, the script creates about 7 different files. What do I do with these now? I assume that the contents of radius.user will have to be added to the users file, but what of the other 6 files? Nico Gazzano Network & Systems Admin MIS Choice Inc. 1699 Wall ST Suite 602 Mount Prospect, IL 60056 Phone 847-690-1900 ext206 Fax 847-690-1350 nicog(a)mischoice.com

2 2

Troubel with Cisco Aironet 1130 and MAC authentication
by Christoffer Dahl Petersen 18 Sep '06

18 Sep '06

Hi! I'm trying to get a Cisco Aironet 1130 to do MAC authentication with freeradius and a pgsql as backend. I Have made my own table in the pgsql witch looks like this: radius=> select * from maskiner; mid | mnavn | mmac | mpwd | mattr | mop -----+--------------+-------------------+------------+-----------+----------+--------+ 9 | 0016cf0157f8 | 0016cf0157f8 | radius | Password | == | where mnavn is the name of the machine, mmac is the MAC of the machine, mpwd is a password field, mattr is the attribute field, mop is the operator. I have tried with an Avaya AP, and it works fine. Here is the authorize table: authorize_check_query = "SELECT mid, mmac, mattr, mpwd, mop \ FROM maskiner WHERE LOWER(mmac) = LOWER('%{SQL-User-Name}') ORDER BY mid" Here is the authenticate table: authenticate_query = "select mpwd from maskiner where mmac = '%{User-Name}'"; Here is the output from freeradius: rad_recv: Access-Request packet from host 192.168.250.28:6001, id=3, length=112 User-Name = "0016cf0157f8" User-Password = "radius" NAS-IP-Address = 192.168.250.28 Called-Station-Id = "00-20-a6-59-ce-93:GandrupII" Calling-Station-Id = "00-16-cf-01-57-f8" NAS-Port = 0 rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_postgresql: query: SELECT mid, mmac, mattr, mpwd, mop FROM maskiner WHERE LOWER(mmac) = LOWER('0016cf0157f8') ORDER BY mid rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = rlm_sql (sql): Released sql socket id: 4 Login OK: [0016cf0157f8/radius] (from client Demo port 0 cli 00-16-cf-01-57-f8) Sending Access-Accept of id 3 to 192.168.250.28:6001 Now since the Cisco AP is sending the User-Name and User-Password in another format we have change freeradius configuration. Here is the authorize table: authorize_check_query = "SELECT mid, mmac, mattr, mmac, mop FROM maskiner \ WHERE LOWER(mmac) = LOWER('%{SQL-User-Name}') ORDER BY mid" Here is the authenticate table: authenticate_query = "select mmac from maskiner where mmac = '%{User-Name}'"; Here is the output from freeradius: rad_recv: Access-Request packet from host 192.168.250.35:1645, id=148, length=115 User-Name = "0016cf0157f8" User-Password = "0016cf0157f8" Called-Station-Id = "0017.0f84.8af0" Calling-Station-Id = "0016.cf01.57f8" Service-Type = Login-User NAS-Port-Type = Wireless-802.11 NAS-Port = 531 NAS-IP-Address = 192.168.250.35 NAS-Identifier = "AP-07" rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_postgresql: query: SELECT mid, mmac, mattr, mmac, mop FROM maskiner WHERE LOWER(mmac) = LOWER('0016cf0157f8') ORDER BY mid rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = rlm_sql (sql): No matching entry in the database for request from user [0016cf0157f8] rlm_sql (sql): Released sql socket id: 4 Login incorrect: [0016cf0157f8/0016cf0157f8] (from client Demo port 531 cli 0016.cf01.57f8) Why won't it work with the Cisco, does it use another dictionary or.... Any help is appreciated!! Thanks in advance, Christoffer

1 0

rlm_perl link error
by Alexander Serkin 18 Sep '06

18 Sep '06

Hi, i'm getting the following error while building rlm_perl module: make[6]: Entering directory `/opt/fr/src/freeradius-1.1.3/src/modules/rlm_perl' /opt/fr/src/freeradius-1.1.3/libtool --mode=link gcc -release 1.1.3 \ -module -export-dynamic -o rlm_perl.la \ -rpath /opt/fr/lib rlm_perl.lo rlm_perl.c /opt/fr/src/freeradius-1.1.3/src/lib/libradius.la \ `perl -MExtUtils::Embed -e ldopts` -lnsl -lresolv -lsocket -lposix4 -lpthread *** Warning: Linking the shared library rlm_perl.la against the *** static library /usr/local/lib/perl5/5.8.6/sun4-solaris/auto/DynaLoader/DynaLoader.a is not portable! gcc -shared -Wl,-h -Wl,rlm_perl-1.1.3.so -o .libs/rlm_perl-1.1.3.so .libs/rlm_perl.o -R/opt/fr/src/freeradius-1.1.3/src/lib/.libs -R/opt/fr/lib /opt/fr/src/freeradius-1.1.3/src/lib/.libs/libradius.so -L/usr/local/lib /usr/local/lib/perl5/5.8.6/sun4-solaris/auto/DynaLoader/DynaLoader.a -L/usr/local/lib/perl5/5.8.6/sun4-solaris/CORE -lperl -ldl -lm -lc -lnsl -lresolv -lsocket -lposix4 -lpthread -lc Text relocation remains referenced against symbol offset in file <unknown> 0x2628 /usr/local/lib/perl5/5.8.6/sun4-solaris/CORE/libperl.a(perl.o) ... does it mean that perl is compiled incorrectly on the machine? It seem to be installed from SMCperl binary package for SunOS 5.8 -- Sincerely Yours, Alexander

2 1

denying access to user from device
by Rob Shepherd 18 Sep '06

18 Sep '06

Dear freeradiuseers, I have my wireless network working great... PEAP supplicants are authenticated from either LDAP or MySQL and the appropriate Tunnel-Private-Group-ID is set to allocate the correct vlan. I also have a cisco VPN concentrator. I must only allow ldap users to authenticate to this. mysql users mustn't get a look in... I tried making a huntgroup in raddb/huntgroups... ciscovpnc NAS-IP-Address == 10.1.33.4 then in raddb/users... DEFAULT HuntGroup-Name == ciscovpnc Autz-Type = ldap however sql is still checked. Could some body shove me in the right direction.. Cheers Rob -- Rob Shepherd | Computer and Network Engineer | Technium CAST | LL57 4HJ rob(a)techniumcast.com | 01248 675024 | 077988 72480

5 8

Freeradius IODBC bug?
by Angelo Compagnucci 18 Sep '06

18 Sep '06

Hi to all! I'm desperate ;( ... I have to work with a MS SQL server from freeradius. Debian team removed feeradius-unixodbc (i've used only unixodbc until now) from repos and i installed freeradius-unixodbc. When i launch freeradius -X i see this errors (with trace enabled): ---------------------------------------------------- rlm_sql (sql): Driver rlm_sql_iodbc (module rlm_sql_iodbc) loaded and linked rlm_sql (sql): Attempting to connect to wireless_admin@192.168.1.21:1433/Radius_DB rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_iodbc #0 ** iODBC Trace file ** Trace started on Mon Sep 18 12:21:31 2006 ** Driver Manager: 03.52.0406.0126 [000000.000053] freeradius 2B88599C0250 ENTER SQLAllocEnv SQLHENV * 0x5b0ea0 [000000.000073] freeradius 2B88599C0250 EXIT SQLAllocEnv with return code 0 (SQL_SUCCESS) SQLHENV * 0x5b0ea0 (0x5b0ee0) [000000.000091] freeradius 2B88599C0250 ENTER SQLAllocConnect SQLHENV 0x5b0ee0 SQLHDBC * 0x5b0ea8 [000000.000105] freeradius 2B88599C0250 EXIT SQLAllocConnect with return code 0 (SQL_SUCCESS) SQLHENV 0x5b0ee0 SQLHDBC * 0x5b0ea8 (0x5b1030) [000000.000124] freeradius 2B88599C0250 ENTER SQLConnect SQLHDBC 0x5b1030 SQLCHAR * 0x63ac40 | Radius_DB | SQLSMALLINT -3 (SQL_NTS) SQLCHAR * 0x5aee00 | wireless_admin | SQLSMALLINT -3 (SQL_NTS) SQLCHAR * 0x2b885a32a700 | **** | SQLSMALLINT -3 (SQL_NTS) [000000.000552] freeradius 2B88599C0250 EXIT SQLConnect with return code -1 (SQL_ERROR) SQLHDBC 0x5b1030 SQLCHAR * 0x63ac40 SQLSMALLINT -3 (SQL_NTS) SQLCHAR * 0x5aee00 SQLSMALLINT -3 (SQL_NTS) SQLCHAR * 0x2b885a32a700 SQLSMALLINT -3 (SQL_NTS) [000000.000595] freeradius 2B88599C0250 ENTER SQLError SQLHENV 0x5b0ee0 SQLHDBC 0x5b1030 SQLHSTMT 0x0 (SQL_NULL_HANDLE) SQLCHAR * 0x7fffffa4e040 SQLINTEGER * 0x7fffffa4e148 SQLCHAR * 0x2b885a2e6b80 SQLINTEGER 256 SQLSMALLINT * 0x7fffffa4e14e [000000.000637] freeradius 2B88599C0250 EXIT SQLError with return code 0 (SQL_SUCCESS) SQLHENV 0x5b0ee0 SQLHDBC 0x5b1030 SQLHSTMT 0x0 (SQL_NULL_HANDLE) SQLCHAR * 0x7fffffa4e040 | IM002 | SQLINTEGER * 0x7fffffa4e148 (0) SQLCHAR * 0x2b885a2e6b80 | [iODBC][Driver Manager]Data source name | | not found and no default driver specifie | | d. Driver could not be loaded | SQLINTEGER 256 SQLSMALLINT * 0x7fffffa4e14e (109) sql_create_socket: SQLConnectfailed: [iODBC][Driver Manager]Data source name not found and no default driver specified. Driver could not be loaded rlm_sql (sql): Failed to connect DB handle #0 rlm_sql (sql): starting 1 rlm_sql (sql): starting 2 rlm_sql (sql): starting 3 rlm_sql (sql): starting 4 rlm_sql (sql): Failed to connect to any SQL server. ---------------------------------------------------- My configuration worked well with unixodbc. If i try with iodbctest "DSN=MSSQL;UID=wireles_admin;PWD=***" everything works well. Why??? Please help me !!! Thanks!!!

1 1

Problems in EAP-TLS in new Windows XP clients
by Jose Marcos Lopez Caravaca 18 Sep '06

18 Sep '06

Hi. I have been stuck in this problem for a quite a long time, I hope you can help me. I have a wireless network using WPA-Enterprise, with EAP-TLS using radius 1.0.2. The system has been working good so far, using Windows XP clients and Linux with wpasupplicant with no problems. On the last month I'm having problems making new Windows XP clients connect to the network, even when old instalations of Windows XP SP2 are working good so far. The OEM Windows XP on the new machines don't interoperate correctly with freeradius, or seems so. Then non-working machines get stuck on the autentication phase and seem to loop the requests all the time. I've tried upgrading freeradius from 1.0.2 to 1.1.3, but the problem still persists, "old" machines connect without any problem but new ones get stuck. Both client and server certificate have the OID's refered in the documentation: Client: # /home/soft-local/openssl-0.9.8c/bin/openssl x509 -in /tmp/personal.pem -noout -text Certificate: Data: Version: 3 (0x2) Serial Number: 206 (0xce) Signature Algorithm: md5WithRSAEncryption Issuer: C=ES, ST=Barcelona, L=Barcelona, O=Universitat Politecnica de Catalunya, OU=Departament de Llenguatges i Sistemes Informatics, CN=Laboratori de Calcul de LSI/emailAddress=lclsi(a)lsi.upc.edu Validity Not Before: Sep 5 10:15:15 2006 GMT Not After : Dec 1 08:00:00 2006 Subject: C=ES, ST=Barcelona, L=Barcelona, O=UPC, OU=LSI, CN=marcos/emailAddress=marcos(a)lsi.upc.edu Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (1024 bit) Modulus (1024 bit): 00:d7:f7:ba:f3:d0:69:ca:bf:c9:33:28:71:a6:cd: 08:1a:74:3e:e4:f1:e1:ed:00:7e:8c:76:1c:d0:43: 7b:1e:32:c0:3f:ad:a5:da:ea:38:96:c9:69:a2:4d: cc:cb:a4:62:24:34:0f:a9:bc:ca:9f:38:d9:84:c3: d9:bd:4d:98:d9:ad:92:82:82:59:2c:0c:64:17:97: 00:d4:c4:f3:b1:03:f4:88:05:de:1e:1b:22:ea:47: 1c:16:b5:f7:65:0f:17:6f:a9:e1:e4:ce:99:96:e5: eb:40:7c:28:d8:e6:b3:be:71:3e:e0:e9:1a:56:d3: e2:44:f7:3d:28:6e:d3:29:3d Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Extended Key Usage: TLS Web Client Authentication Signature Algorithm: md5WithRSAEncryption a1:26:ae:7b:43:33:3e:40:87:20:68:24:00:13:e2:37:2c:ae: f9:e4:17:1f:11:32:53:b2:14:3e:11:f4:d9:1a:c5:b7:2e:37: 3b:41:5d:75:13:c7:0d:be:bc:51:97:b8:06:48:07:de:5f:02: 8f:27:5b:c9:7d:33:bf:84:8c:db:9f:74:3c:2e:42:f6:96:1b: 6a:c4:47:b7:62:53:8d:22:6f:14:32:9a:67:5e:9d:8f:d8:b4: ca:fc:e9:ab:fd:16:4f:c7:f9:91:9b:65:43:e7:b2:35:6a:a2: 9c:0b:0f:3a:1d:d9:75:ea:3b:4a:68:98:22:de:ba:f2:3e:f7: a4:a8 Server: # /home/soft-local/openssl-0.9.8c/bin/openssl x509 -in /home/soft-local/freeradius-1.1.3/etc/raddb/certs/cert-srv.pem -noout -text Certificate: Data: Version: 3 (0x2) Serial Number: 153 (0x99) Signature Algorithm: md5WithRSAEncryption Issuer: C=ES, ST=Barcelona, L=Barcelona, O=Universitat Politecnica de Catalunya, OU=Departament de Llenguatges i Sistemes Informatics, CN=Laboratori de Calcul de LSI/emailAddress=lclsi(a)lsi.upc.edu Validity Not Before: Mar 15 11:13:27 2006 GMT Not After : Mar 15 11:13:27 2007 GMT Subject: C=ES, ST=Barcelona, L=Barcelona, O=Departament de Llenguatges i Sistemes Informatics, OU=Laboratori de Caulcul de LSI, CN=Servei Wireless de LCLSI/emailAddress=lclsi(a)lsi.upc.edu Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (1024 bit) Modulus (1024 bit): 00:aa:eb:d5:19:3d:63:4b:ee:b2:ae:c2:73:24:69: cd:61:0a:44:66:45:fe:e9:2e:c0:90:be:1a:c5:39: 2a:95:9e:53:ee:0f:29:01:28:43:6e:e6:11:44:09: 1c:e7:ae:b8:72:22:9d:03:60:26:6f:90:92:cf:bb: 22:66:61:3f:ba:5a:89:62:c0:aa:09:aa:9c:2f:05: b9:67:c1:b2:0e:ad:5e:9d:ab:c4:45:79:51:97:fd: 15:da:ba:29:06:5f:fb:4a:d0:7d:80:2e:7d:b9:91: 58:32:56:a8:69:36:7e:9c:54:66:ac:25:10:62:be: e1:60:f0:aa:9b:02:fc:b6:8b Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Extended Key Usage: TLS Web Server Authentication Signature Algorithm: md5WithRSAEncryption bb:b0:de:06:6a:03:fd:34:f7:38:8d:07:e7:b7:ee:97:0a:94: f2:82:ab:10:6b:08:cf:4c:9f:97:e7:be:a3:1b:12:e5:9a:b1: 86:35:85:20:06:4a:a9:51:f3:83:de:69:6e:e5:c4:22:e5:88: 17:f4:23:e7:70:5b:f6:d2:ae:50:c5:e6:c4:fd:93:f4:b8:61: 92:df:1d:9d:01:1b:16:87:02:6c:a5:02:87:7b:ad:bc:a3:65: 26:7c:82:81:48:e9:62:60:ab:c5:63:fc:9f:17:d0:d9:7f:53: 3d:e7:bc:85:f9:01:a9:97:e7:88:2a:d9:b2:a2:8a:7c:1c:bd: 85:4a And the traces of the server: - Working on an "old" machine attached as http://www.lsi.upc.edu/~marcos/correcto.txt - Non-Working on a "new" machine attached as http://www.lsi.upc.edu/~marcos/incorrecto.txt Thank you all.

2 1

FreeRadius 1.13 support Dual Stack IPv4/IPv6 ?????
by 나종현 18 Sep '06

18 Sep '06

3 3