- Freeradius-Users - lists.freeradius.org

Server Specs
by King, Michael 01 Jun '06

01 Jun '06

We're going to be setting up a few new FreeRADIUS servers on virtual hardware. The server admin is asking me what I need for specs. (Virtually, they can allocate whatever I need) It's about 200-500 simultaneous authentications. (This is my prediction for the next 4 years, we're about 10 right now). Using NTLM-auth to talk to Active Directory, and performing PEAP. I'm guessing 1ghz of cpu, 512MB of RAM, and 30gig of HD. Suggestions, comments, criticisms?

2 1

processes invoked goes <defunct>
by Fabio 01 Jun '06

01 Jun '06

Hi, I am using freeradius 1.0.5, configured so that when a user fails the password for X times, a mail is sent to a sysadmin. I have added the following to modules section: exec accept_notify { wait = no program = "/usr/local/etc/raddb/radius_reject_notify %{User-Name} accept %{FreeRADIUS-Proxied-To}" input_pairs = request } exec reject_notify { wait = no program = "/usr/local/etc/raddb/radius_reject_notify %{User-Name} reject %{FreeRADIUS-Proxied-To}" input_pairs = request } and this is my posth-auth section: post-auth { accept_notify Post-Auth-Type REJECT { reject_notify } } radius_reject_notify is the bash script attached. However, when a user log in and the script is executed, I see that the script remains in a <defunct> state. After some time I see hundreds of such processes: Output of ps -e: 13110 ? 00:00:00 radius_reject_n <defunct> 13232 ? 00:00:00 radius_reject_n <defunct> 13233 ? 00:00:00 radius_reject_n <defunct> .... Has someone idea why freeradius does not close correctly my script? Thanks, Fabio radius_reject_notify: #!/bin/bash # #Sintax: # #mail_notify user access type # user: user name # access: accept or reject # type: accepted only if ( == FreeRADIUS-Proxied-To ) == 127.0.0.1 # # TRY: number of retry TRY=10 FAILED_USERS_DIR=/tmp/radius_user_fail/ MAIL_ADMINS="admin(a)domain.com" USER_RETRY=0 CURRENT_USER=$1 ACCESS=$2 failed() { mkdir -p $FAILED_USERS_DIR if [ -e $FAILED_USERS_DIR/$CURRENT_USER ] then USER_RETRY=`cat $FAILED_USERS_DIR/$CURRENT_USER` fi USER_RETRY=$(( USER_RETRY + 1 )) echo $USER_RETRY > $FAILED_USERS_DIR/$CURRENT_USER if (( USER_RETRY == $TRY )) then #Limit exceded! send_mail fi ; } success() { if [ -e $FAILED_USERS_DIR/$CURRENT_USER ] then rm -f $FAILED_USERS_DIR/$CURRENT_USER fi } send_mail() { HOSTNAME=`hostname` env MAILRC=/dev/null from=radius.admin@$HOSTNAME smtp=smtp.domain.com nail -n -s "RADIUS - Autentication failed $TRY times" $MAIL_ADMINS <<-END $CURRENT_USER failed authentication for $TRY times. END } case $3 in '127.0.0.1') case $ACCESS in 'accept') success ;; 'reject') failed ;; esac ;; esac

2 1

Auth-Type = Reject not 'working'
by A.L.M.Buxey＠lboro.ac.uk 01 Jun '06

01 Jun '06

hi, the recent post mentioning Auth-Type = System reminded me.... if I've got a Auth-Type = Reject int he users file, then when making a request with a remote RADIUS client, then the request times out when freeradius is running as a normal process daemon... on Fedora, this is running as a service with the '-y' option... however, this timeout is variable..and sometimes...just sometimes it works. however, when running freeradius is debug mode, with -X, the Reject reply message is pretty fast...though still a lot slower than an Access-Accept message for a valid user - even though the valid user is in a database or a kerberos check. I assumed that a Auth-Type := Reject was an instant hit, with no further procedures... why then, when run in debug mode, does FreeRADIUS happily reject the client request but when run as a normal process, it throws the request towards other Auth mechanisms? alan

3 3

RE: Re: freeradius 1.1.1 and mysql issues
by simon＠434canada.com 01 Jun '06

01 Jun '06

Hi, I have tried reordering the elements in the radiusd.conf file so that the database is tried first, and then commented out the section to check the users file, and I am still having the same issues. Here is the output again: Ready to process requests. rad_recv: Access-Request packet from host 10.10.1.1:1320, id=0, length=123 User-Name = "simon" NAS-IP-Address = 10.10.1.1 Called-Station-Id = "0014bff3dac8" Calling-Station-Id = "0013ce29c6d7" NAS-Identifier = "0014bff3dac8" NAS-Port = 56 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200000a0173696d6f6e Message-Authenticator = 0x68b3f01e605eb032281dd6c99dfd9e52 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "simon", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 10 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 radius_xlat: 'simon' rlm_sql (sql): sql_set_user escaped user --> 'simon' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'simon' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'simon' ORDER BY id radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'simon' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'simon' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'simon' ORDER BY id' rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'simon' ORDER BY id radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'simon' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'simon' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Login incorrect: [simon/<no User-Password attribute>] (from client linksys-434 port 56 cli 0013ce29c6d7) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 0 to 10.10.1.1 port 1320 Waking up in 5 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 447ef7e2 Nothing to do. Sleeping until we see a request. As before, it still authenticates perfectly when I try it with either NTRadPing or radtest. Thanks again, Simon >hi, > >you say it works okay with NTRadPing and that when you use an entry in users >file it works...however >in the log you supplied its still matching an entry in the users file - and >the server is then >happy to use that matching entry rather than one in the DB. the log you posted >also shows that it >is attempting to use the files method...and that the match told it to use >Local authentication..the >database query is then superfluous. > >alan >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html

4 3

EAP (PEAP) problems
by Drew Linsalata 01 Jun '06

01 Jun '06

This is freeradius 1.1.1 with a Proxim/Orinoco AP700. We're configured to use PEAP. We seem to be hung up on the EAP start from the AP. Here's some log output. Note the "No EAP Start" part, which I think tells us that the AP isn't relaying the EAP Start properly from the supplicant. Any feedback from the gurus? (-: rad_recv: Access-Request packet from host ***.***.***.***:6001, id=22, length=154 User-Name = "testtwo" NAS-IP-Address = ***.***.***.*** Called-Station-Id = "00-20-a6-5d-9c-d1:ourtestssid" Calling-Station-Id = "00-20-a6-4c-16-7f" NAS-Identifier = "ORiNOCO-AP-700-5d-9c-d1" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0204000c017465737474776f Message-Authenticator = 0x62af36a7da3b8f655c8a9cda6dba34eb Wed May 31 13:50:59 2006 : Debug: Processing the authorize section of radiusd.conf Wed May 31 13:50:59 2006 : Debug: modcall: entering group authorize for request 3 Wed May 31 13:50:59 2006 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 3 Wed May 31 13:50:59 2006 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 3 Wed May 31 13:50:59 2006 : Debug: modcall[authorize]: module "preprocess" returns ok for request 3 Wed May 31 13:50:59 2006 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 3 Wed May 31 13:50:59 2006 : Debug: rlm_realm: No '@' in User-Name = "testtwo", looking up realm NULL Wed May 31 13:50:59 2006 : Debug: rlm_realm: No such realm "NULL" Wed May 31 13:50:59 2006 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 3 Wed May 31 13:50:59 2006 : Debug: modcall[authorize]: module "suffix" returns noop for request 3 Wed May 31 13:50:59 2006 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 3 Wed May 31 13:50:59 2006 : Debug: rlm_eap: EAP packet type response id 4 length 12 Wed May 31 13:50:59 2006 : Debug: rlm_eap: No EAP Start, assuming it's an on-going EAP conversation Wed May 31 13:50:59 2006 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 3 Wed May 31 13:50:59 2006 : Debug: modcall[authorize]: module "eap" returns updated for request 3 Wed May 31 13:50:59 2006 : Debug: modsingle[authorize]: calling files (rlm_files) for request 3 Wed May 31 13:50:59 2006 : Debug: users: Matched entry testtwo at line 2 Wed May 31 13:50:59 2006 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 3 Wed May 31 13:50:59 2006 : Debug: modcall[authorize]: module "files" returns ok for request 3 Wed May 31 13:50:59 2006 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 3 Wed May 31 13:50:59 2006 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 3 Wed May 31 13:50:59 2006 : Debug: modcall[authorize]: module "mschap" returns noop for request 3 Wed May 31 13:50:59 2006 : Debug: modcall: leaving group authorize (returns updated) for request 3 Wed May 31 13:50:59 2006 : Debug: rad_check_password: Found Auth-Type Accept Wed May 31 13:50:59 2006 : Debug: rad_check_password: Auth-Type = Accept, accepting the user Wed May 31 13:50:59 2006 : Auth: Login OK: [testtwo/<no User-Password attribute>] (from client testAP port 0 cli 00-20-a6-4c-16-7f) Sending Access-Accept of id 22 to ***.***.***.*** port 6001 Wed May 31 13:50:59 2006 : Debug: Finished request 3 Wed May 31 13:50:59 2006 : Debug: Going to the next request Wed May 31 13:50:59 2006 : Debug: --- Walking the entire request list --- Wed May 31 13:50:59 2006 : Debug: Waking up in 6 seconds... Wed May 31 13:51:05 2006 : Debug: --- Walking the entire request list --- Wed May 31 13:51:05 2006 : Debug: Cleaning up request 3 ID 22 with timestamp 447dd783 Wed May 31 13:51:05 2006 : Debug: Nothing to do. Sleeping until we see a request. -- Drew Linsalata The Gotham Bus Company, Inc. Dedicated Servers and Colocation Solutions Long Island, New York http://www.gothambus.com

3 4

RE: RE: Re: freeradius 1.1.1 and mysql issues
by simon＠434canada.com 01 Jun '06

01 Jun '06

There is a password in the database (in the radcheck table) associated with the username. I am also supplying both the username and password on my laptop as I am trying to connect. I currently have the Auth-Type being set (:=) to Local in the radgroupcheck table. I believe this should all be set up properly. Simon >>> modcall[authorize]: module "sql" returns ok for request 0 >>>modcall: leaving group authorize (returns updated) for request 0 >>> rad_check_password: Found Auth-Type Local >>>auth: type Local >>>auth: No User-Password or CHAP-Password attribute in the request >>>auth: Failed to validate the user. >>>Login incorrect: [simon/<no User-Password attribute>] (from client >>linksys->434 port 56 cli 0013ce29c6d7) >> >>There is no password ? Is that okay? >> >>You can set Auth-Type to Accept if the user is found in sql ! >>If that is what you actually want. >> >>Regards, >> >>Edvin >> >> >>- >>List info/subscribe/unsubscribe? See >>http://www.freeradius.org/list/users.html

1 0

PEAP + Active directory
by Kartthik Raghunathan 01 Jun '06

01 Jun '06

Am having a strange problem after my supplicant get authenticated to my active directory. My supplicant trying to get authenticated to active directory or validating identity every 60 mins, which disturbs wireless connection that bother me a lot. Is this normal or can i set the timer to authenticate every 120 mins or whatever timing i like. Am using dynamic WEP and it has been set to change the key every 6 hours. Any help will be really appreciated. Thanks in advance. Kartthik -- _______________________________________________ Search for businesses by name, location, or phone number. -Lycos Yellow Pages http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.as…

1 0

PPPoE server + MySQLbackend tutotrial
by Rani Ahmed 01 Jun '06

01 Jun '06

plz do you have totorial links to PPPoE server + MySQL backend?? strait forward and easy to understand. thanks this tool really needs Howtos

1 0

1.1.2 eap problem
by VannMann32 . 01 Jun '06

01 Jun '06

Hi ! Upgrading from 1.1.1 to 1.1.2 and now I get this error message : Thu Jun 1 12:26:22 2006 : Info: rlm_eap_tls: Loading the certificate file as a chain Thu Jun 1 12:26:22 2006 : Error: rlm_eap: SSL error error:02001002:system library:fopen:No such file or directory Thu Jun 1 12:26:22 2006 : Error: rlm_eap_tls: Error reading Trusted root CA list Thu Jun 1 12:26:22 2006 : Error: rlm_eap: Failed to initialize type tls Thu Jun 1 12:26:22 2006 : Error: radiusd.conf[10]: eap: Module instantiation failed. Thu Jun 1 12:26:22 2006 : Error: radiusd.conf[1735] Unknown module "eap". Thu Jun 1 12:26:22 2006 : Error: radiusd.conf[1722] Failed to parse authenticate section. My system is a FreeBSD 6.1-Stable

1 0

proxy_fail_type attribute
by Geoffroy Arnoud 01 Jun '06

01 Jun '06

Hi, I just get the last CVS update, and I discovered a "hidden" attribute in mainconfig.c, name "proxy_fail_type". By reading the source code, my understanding is that setting this attribute to "fail" (for example) in proxy.conf, and setting the value "fail" for Post-Proxy-Type in dictionary.freeradius.internal, will allow FreeRADIUS to execute a module when the proxy of a request failed (no response from server or other cases). My 1st question: - Am I right (or near to the truth)? I saw that this was not shipped into 1.1.2. But this feature appeared by the end of 2004. So my 2nd and 3rd questions are: - Has anyone used or is anyone using this feature on prodcution deployement? - Is this feature planned to be shipped in 1.2.x? Thank you in advance. Geof.

1 0