- Freeradius-Users - lists.freeradius.org

Bug with multiple IPs?
by Matt 15 Jun '06

15 Jun '06

I have freeradius running on a machine with 2 IPs. I have it binding to all available IPs. xxx.xxx.xxx.44 is the main IP of the machine xxx.xxx.xxx.26 is the secondary IP. (eth0:1) When a request comes in on .26 freeradius processes it and THEN sends the reply out .44! Is this the way it is suppose to be acting?

3 3

Problems Using Digest-HA1 with MySQL storage backend
by Tavis P 15 Jun '06

15 Jun '06

I just installed Freeradius 1.1.2 to see how the Digest-HA1 modifications work and i was unable get it to work when using a sql/mysql storage backend. Manually defining the user/attribute in the "users" file works I had a look at the wiki on the freeradius site however it doesn't mention anything regarding a SQL backend, am i missing somthing? Output from radiusd -X: rad_recv: Access-Request packet from host 127.0.0.1:32923, id=186, length=258 User-Name = "200110005339(a)hq.galnet.ca" Digest-Attributes = 0x0a0e323030313130303035333339 Digest-Attributes = 0x010e68712e67616c6e65742e6361 Digest-Attributes = 0x022a34343930393537353134653736633735626235613463353361636163373161393264323365623339 Digest-Attributes = 0x04177369703a737062332e68712e67616c6e65742e6361 Digest-Attributes = 0x030a5245474953544552 Digest-Attributes = 0x050661757468 Digest-Attributes = 0x090a3030303030303031 Digest-Attributes = 0x080a3764626539636533 Digest-Response = "054d7dc7b2d6d969bcd60c5000d1bf3c" Service-Type = IAPP-Register Sip-Uri-User = "200110005339" NAS-Port = 5060 NAS-IP-Address = 127.0.0.1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 37 modcall[authorize]: module "preprocess" returns ok for request 37 rlm_realm: Looking up realm "hq.galnet.ca" for User-Name = "200110005339(a)hq.galnet.ca" rlm_realm: Found realm "DEFAULT" rlm_realm: Adding Stripped-User-Name = "200110005339" rlm_realm: Proxying request from user 200110005339 to realm DEFAULT rlm_realm: Adding Realm = "DEFAULT" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "DEFAULT" returns noop for request 37 rlm_digest: Adding Auth-Type = DIGEST modcall[authorize]: module "digest" returns ok for request 37 radius_xlat: '200110005339' rlm_sql (sql): sql_set_user escaped user --> '200110005339' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radius_check WHERE Username = '200110005339' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 2 radius_xlat: '' radius_xlat: 'SELECT id,UserName,Attribute,CONCAT(IFNULL(SubAttribute,''), IFNULL(Value, '')) AS Value,op FROM radius_reply WHERE Username = '200110005339' ORDER BY id' radius_xlat: '' rlm_sql (sql): Released sql socket id: 2 rlm_sql (sql): No matching entry in the database for request from user [200110005339] modcall[authorize]: module "sql" returns notfound for request 37 users: Matched entry DEFAULT at line 11 modcall[authorize]: module "files" returns ok for request 37 modcall: leaving group authorize (returns ok) for request 37 rad_check_password: Found Auth-Type Digest auth: type "digest" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 37 rlm_digest: Configuration item "User-Password" or Digest-HA1 is required for authentication. modcall[authenticate]: module "digest" returns invalid for request 37 modcall: leaving group authenticate (returns invalid) for request 37 auth: Failed to validate the user. Sending Access-Reject of id 186 to 127.0.0.1 port 32923 Finished request 37 MySQL output when manually executing the queries defined above: mysql> SELECT id,UserName,Attribute,Value,op FROM radius_check WHERE Username = '200110005339' ORDER BY id; +----+--------------+--------------+----------------------------------+----+ | id | UserName | Attribute | Value | op | +----+--------------+--------------+----------------------------------+----+ | 17 | 200110005339 | Digest-HA1 | e5282fc6665a69aed77b7d0a42d8f544 | = | +----+--------------+--------------+----------------------------------+----+ 1 row in set (0.00 sec) mysql> SELECT id,UserName,Attribute,CONCAT(IFNULL(SubAttribute,''), IFNULL(Value, '')) AS Value,op FROM radius_reply WHERE Username = '200110005339' ORDER BY id -> ; +----+--------------+-----------+------------+----+ | id | UserName | Attribute | Value | op | +----+--------------+-----------+------------+----+ | 24 | 200110005339 | SIP-AVP | is_local#1 | += | +----+--------------+-----------+------------+----+ 1 row in set (0.00 sec) Database Schemas(MySQL 5.0.22): CREATE TABLE `radius_check` ( `id` int(11) unsigned NOT NULL auto_increment, `UserName` varchar(64) NOT NULL default '', `Attribute` varchar(32) NOT NULL default '', `op` char(2) NOT NULL default '==', `Value` varchar(253) NOT NULL default '', PRIMARY KEY (`id`), KEY `UserName` (`UserName`(32)) ) ENGINE=MyISAM DEFAULT CHARSET=latin1 CREATE TABLE `radius_reply` ( `id` int(11) unsigned NOT NULL auto_increment, `UserName` varchar(64) NOT NULL default '', `Attribute` varchar(32) NOT NULL default '', `SubAttribute` varchar(64) default NULL, `op` char(2) NOT NULL default '=', `Value` varchar(253) NOT NULL default '', PRIMARY KEY (`id`), KEY `UserName` USING BTREE (`UserName`(32),`SubAttribute`(32)) ) ENGINE=MyISAM DEFAULT CHARSET=latin1

3 3

rlm_perl forking zombies
by david.suarezdelis＠telefonica.es 15 Jun '06

15 Jun '06

Greetings, I have FreeRadius 1.1.0 working on Debian 3.1 on an Intel box. When using rlm_perl, the authenticate() sub does its job and, eventually, calls a method to send an email to a certain address before returning OK. The problem is that this SMTP connection can take longer than wished, therefore I am forking the SMTP call, so the authentication process can go on as normal. The problem with this solution, though, is that--as I cannot wait for the SMTP connection to be done--the process is left as a zombie. I have, therefore, used a double forking solution, where the grandfather returns inmediately to the authorize() function, and the child forks again, and waits (waitpid()) for the new (grand)child to do the job, so no zombie is created. By itself, this works and no zombies are left behind, as expected. However, when used with FreeRadius, zombies are left behind. I have tried to 'IGNORE' SIGCHLD, to use reaper function (and all the other tricks in perlipc(1)) to no avail (I am even using Proc::Fork to simplify things so I am sure I am doing things properly). Is this a problem with my calling this inside the authenticate() function, or with rlm_perl, or...? Is this a problem with 1.1.0 and solved with a later version? Any help appreciated. thanks a lot! david PS- Perl is version 5.8.4 compiled with threads and ithreads PPS- has the RLM_PERL module documentation's been improved in more recent versions, by any chance? ___________________________________________________________________________ Este mensaje se dirige exclusivamente a su destinatario y puede contener información privilegiada o confidencial. Si no es vd. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización está prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción. El correo electrónico vía Internet no permite asegurar la confidencialidad de los mensajes que se transmiten ni su integridad o correcta recepción. Telefónica no asume ninguna responsabilidad por estas circunstancias. This message is intended exclusively for its addressee and may contain information that is CONFIDENTIAL and protected by a professional privilege or whose disclosure is prohibited by law.If you are not the intended recipient you are hereby notified that any read, dissemination, copy or disclosure of this communication is strictly prohibited by law. If this message has been received in error, please immediately notify us via e-mail and delete it. Internet e-mail neither guarantees the confidentiality nor the integrity or proper receipt of the messages sent. Telefónica does not assume any liability for those circumstances. ___________________________________________________________________________

3 2

ntdomain_hack
by wekz 15 Jun '06

15 Jun '06

Hello everyone, I've configured a freeradius 1.1.1 + LDAP for eap-tls authentication with domains. authorize { preprocess ntdomain ... } realm host { type = radius authhost = LOCAL accthost = LOCAL strip } This configuration gives an error: rlm_eap: Identity does not match User-Name, setting from EAP Identity. When I enable with_ntdomain_hack in eap.conf it works quite well. Could anyone tell me why it's neccesary? The problem is that this secondary_radius do proxy when it doesn't find the user in its LDAP and the master_radius gives this error: rlm_eap: Identity does not match User-Name, setting from EAP Identity. I've tried in master_radius the same configuration with and without ntdomain_hack and it fails. I've been thinking of adding the realm before the secondary do proxy, so the master could treat the request as it's been local. But I don't like this too much. Does anyone have a better idea of what to do? Thanks.

4 4

Re: Freeradius 1.1.1: 'sqlippools' concurrency problems
by Robles Rodriguez,Alejandro 15 Jun '06

15 Jun '06

"Alan DeKok" <aland(a)nitros9.org> wrote: > A simple solution would be to go to the bottom of rlm_sqlippool.c, >and change it from RLM_TYPE_THREAD_SAFE to RLM_TYPE_THREAD_UNSAFE. >Then re-compile & re-install. That would be the case if I only had one single radiusd running, however as already mentioned this solution encompasses a number of radius servers each with its own mysql server adn the same storage (NDB cluster) behind the scenes i.e. virtually sharing data storage. By implementing the suggestion (which by the way didn't know it was possible so thanks for the tip) I would only solve it for one radius server (at the expense of a lower performance) but not wen several radius servers are at play.

2 1

Proxy Error Again
by mad 15 Jun '06

15 Jun '06

Hello, I had open a subject, where I explained a problem with the function proxy of FreeRadius. http://lists.freeradius.org/mailman/htdig/freeradius-users/2006-May/053544.… So, I have try to install on an other computer ... And I have always the problem ... It's possible that the problem is in the configuration ? Also, I have an other problem, that I explain here because there are maybe a relation ... In the huntgroup file, I guess that "Client-Ip-Address == xx.xx.xx.xx" are not know, just "NAS-IP-Address" is right ... Thanks Best regards, Psymad

1 0

Authentication with Kerberos
by thomas hahusseau 15 Jun '06

15 Jun '06

Hello, I would like to set up that kind of configuration : EAP-PEAP(Mschapv2) Request ---> AP ---> Freeradius ----> Kerberos authentication to an Active Directory In fact i would like to use Kerberos (wich is supported by Active Directory) instead of ntlm_auth, in freeradius features list avalaible onf the official website I have found : - authentication to a Windows Domain Controller (via ntlm_auth and winbindd) - Kerberos authentication Anyone can confirm this possibility to use Kerberos auth with freeradius and maybe any how-to or advices ? thank you Thomas Hahusseau

2 2

\000 in "octets" attribute?
by Erik Inge Bolsø 15 Jun '06

15 Jun '06

Hello. I'm having a curious problem with a vendor-specific single-byte "octets"-attribute and attr_rewrite. attr_rewrite att1 { attribute = Vendor-Specific-Thingie searchin = reply searchfor = "0" replacewith = "\000" } Essentially, I'm trying to rewrite an ascii "0" to a single-byte 0x00 value. But after this rewrite rule, a zero-byte value is returned instead. Any way to get around this? With \001, \002, etc, all's well. (incidentally, this is freeradius version 1.0.1 in RHEL4) -- Erik Bolsø Linpro AS

3 4

public secret and public radius server. Is it secure?
by sophana 15 Jun '06

15 Jun '06

Hi I'd like to make a public hotspot management system with chillispot and freeradius. I saw in the freeradius source that the NAS are identified from the ip address, and the secret is determined from it. My problem is that there can be hotspots on dynamic ip addresses. The solution I found actually is to have an unique secret shared with all hotspots. So the secret is known by everybody. My question is : - What can a malicious user can do with the secret? Can it alter accounting and other things? (chillispot uses chap auth-type) - Is there a way of maintaining a per hotspot secret with dynamic ip addresses? Regards Sophana

7 15

PEAP
by Naveen 15 Jun '06

15 Jun '06

Hi All, I just want to configure freeradius with PEAP ( MS-Chap V2) . iam new to freeradius and certificates. I just want to clear from experts here that does I need any certificate in client side if I use my ownca with open SSL ? Thanks for help Regards Naveen

2 3