- Freeradius-Users - lists.freeradius.org

Freeradius - Cisco L2TP Tunnel - Authentication problem.
by Tony Spencer 17 Feb '06

17 Feb '06

Hi I have an issue with authentication using Freeradius (freeradius-1.0.1-3) We were running L2TPNS on a Linux box and authenticating fine using CHAP to the Freeradius server. However because of increased volume of users (DSL and Dial) we need to move to a Cisco 7200 so it could terminate the tunnel. The tunnel terminates fine but authentication is failing because the Cisco is sending PAP authentication and we use CHAP, in fact I would know how to move to PAP anyway. No matter what we put into the Cisco config it still uses PAP, even telling it to refuse PAP. The Cisco is running IOS 12.2.(6) and here is the relevant lines of config for the tunnel and authentication: ######################## aaa new-model aaa authentication ppp default group radius aaa authorization network default group radius if-authenticated aaa accounting network default start-stop group radius multilink virtual-template 1 vpdn enable ! vpdn-group 1 accept-dialin protocol l2tp virtual-template 1 terminate-from hostname tunnel local name gw1 l2tp tunnel password 7 xxxxxxxxxx source-ip 10.0.0.1 interface Virtual-Template1 ip unnumbered FastEthernet1/0 ip mroute-cache no logging event link-status no keepalive timeout absolute 4320 0 no peer default ip address ppp authentication chap callin ppp multilink ! ip local pool IP-POOL 192.168.0.1 192.168.1.254 ip classless ip route 0.0.0.0 0.0.0.0 10.0.0.254 no ip http server ip pim bidir-enable ! radius-server host 192.168.1.12 auth-port 1645 acct-port 1646 key xxxxxx radius-server retransmit 2 ############### Here is a line from the radius users file that authentication is failing for: ###### user1 Auth-Type := Local, User-Password== "jijyocspok" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-Address = 192.168.2.22, Framed-Netmask = 255.255.255.255, Framed-Compression = Van-Jacobsen-TCP-IP ###### Here is the radius log entries for when the login fails from the Cisco and passes from the L2TPNS server: #### Thu Feb 16 23:30:41 2006 : Auth: Login incorrect: [user1/jijyocspok] (from client l2tp port 3) Fri Feb 17 08:22:43 2006 : Auth: Login OK: [user1/<CHAP-Password>] (from client l2tp port 3) ###### I was wondering if anyone had seen a problem like this before and found a solution. Is the Cisco at fault, does it have a bug in it? Should I just move to PAP authentication, is so how do I do that? But doesn't Windows PC's send CHAP? Would it still work? Any help would be appreciated. Thanks Tony

3 3

load and threads
by Velikanov 17 Feb '06

17 Feb '06

Good day. I use FreeRadius 1.1.0 with Oracle DB on Red Hat Enterprise Linux ES release 3 (Taroon Update 3) Kernel 2.4.21-20.ELsmp on an i686 I made a test load on server and everything is good when I start Freeradius in debug mode # /usr/local/sbin/radiusd -X top shows me 13:04:10 up 70 days, 1:06, 5 users, load average: 1,77, 1,57, 1,88 114 processes: 111 sleeping, 3 running, 0 zombie, 0 stopped CPU states: cpu user nice system irq softirq iowait idle total 66,7% 0,0% 3,5% 0,0% 0,0% 0,3% 29,2% Mem: 2307652k av, 2283924k used, 23728k free, 0k shrd, 116652k buff 1578192k actv, 300500k in_d, 36092k in_c Swap: 2048152k av, 219780k used, 1828372k free 1694328k cached But when I start Freeradius in work mode # /usr/local/sbin/radiusd under the same test load top shows me in 10-15 minutes: 11:50:27 up 69 days, 23:52, 3 users, load average: 37,25, 30,91, 31,58 114 processes: 92 sleeping, 22 running, 0 zombie, 0 stopped CPU states: cpu user nice system irq softirq iowait idle total 91,1% 0,0% 8,7% 0,0% 0,0% 0,0% 0,0% Mem: 2307652k av, 2250580k used, 57072k free, 0k shrd, 151768k buff 1541388k actv, 299248k in_d, 35108k in_c Swap: 2048152k av, 178648k used, 1869504k free 1671720k cached I see radiusd threads when do the command #ps -efm | grep radiusd in radius.log there are very many such string: Fri Feb 17 12:08:40 2006 : Error: WARNING: Unresponsive child (id 1347701680) fo r request 2937 and such string: Fri Feb 17 12:06:16 2006 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 My questions are: 1. What is the reason of such FreeRadius behavior? What must I do? 2. Why load of server during #radiusd -X is lover then during #radiusd ? Seems to be vice-versa? 3.How must I start FreeRadius to make many processes (not threads), maybe it help me to decrease the load of server and to increase the speed of packets handling Thanks.

2 1

freeradius 1.1.0 doesn't cope well with reloads
by André Lemos 17 Feb '06

17 Feb '06

1 0

Basic problems getting things to run
by Geoff Silver 17 Feb '06

17 Feb '06

Hi Folks, I've been tasked at my work w/ getting a radius backend working with our Cisco 3000 concentrators to do certificate auth. We're currently running an old version of gnu radius for our standard radius auth, but I'd like to move to freeradius so that we can eventually use some features like the ldap backend. In the mean time, I've just been trying to get it working, and I've been coming up short. Forgive me if I'm missing something incredibly obvious, but I absolutely can't get auth to work. ever. For starters, here's what I see when running 'radiusd -AX': rad_recv: Access-Request packet from host 127.0.0.1:34193, id=136, length=61 Attr-1 = 0x6a617468616e69736d Attr-2 = 0xad790d5790cec60e1f908174aabe7335 Attr-4 = 0x7f000001 Attr-5 = 0x00000001 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 users: Matched entry jathanism at line 121 modcall[authorize]: module "files" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall: group authorize returns ok for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [jathanism] (from client localhost port 0) WARNING: Unprintable characters in the password. ? Double-check the shared secret on the server and the NAS! Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- That's running the following locally for testing as the client: # echo 'User-Name= "jathanism", Password = "jathanism", NAS-IP-Address = 127.0.0.1, NAS-Port = 1' | /opt/reverb/bin/radclient -d /opt/reverb/share/dictionary -x 127.0.0.1 auth 1234test1234 Sending Access-Request of id 136 to 127.0.0.1 port 1812 User-Name = "jathanism" Password = "jathanism" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=136, length=20 My user's file right now looks like: jathanism Auth-Type := Local User-Password == "jathanism" DEFAULT Auth-Type := Accept Though I've tried as little as just the DEFAULT line, as well as specifying "Accept" for a specific user. I've also tried PAP and CHAP, none of which are ever successful. My clients.conf file looks like: client 127.0.0.1 { secret = 1234test1234 shortname = localhost nastype = other # localhost isn't usually a NAS... } And what I suspect are the most important parts of my radiusd.conf look like: authorize { preprocess files chap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } } I had tried adding an 'Auth-Type Accept' or 'Auth-Type Local' line, but couldn't get them to work either. The thing that worries me most is the "auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user" error throw by radiusd - no matter what I've tried to do to the radiusd.conf or users files, it ALWAYS says that. The "WARNING: Unprintable characters in the password. ? Double-check the shared secret on the server and the NAS!" also frightens me, though I wonder if that's related (the secret is definitely right, because if I change it, radclient tells me the secret is wrong). I'm completely at a loss right now. I've looked at auth.c and some of the other code, and it seems to me that auth_type just isn't ever getting populated. Incidentally, the comments in the users file indicate stuff like: bob Auth-Type := Local, User-Password == "bobpass" should work, but radiusd won't start unless it looks like: bob Auth-Type := Local User-Password == "bobpass" I can't tell if that's a documentation problem, or a bug, or indicitative of some larger issue, but I thought I'd mention it. FWIW, I've tried both freeradius 1.0.5 and 1.1.0. They were built on Red Hat EL 3.0 Advanced Server with the stock Red Hat build tools. Thanks for any help anyone can provide. I hate to go back to gnu radius, but I've got to get this working by next Friday or else I won't have much of a choice. If anyone willing to assist would like any additional info/configs/strace output/etc, just ask and I'd be happy to provide them.

2 2

Any Trusted CA problem
by Torkel Mathisen 17 Feb '06

17 Feb '06

Hi, I run freeradius 1.0.5 with PEAP/MS-CHAPv2 authentication through the users file. I got a problem with the "Any Trusted CA" part on some of my clients. Some of the clients can't uncheck that option in the driver and then they won't be able to use the WLAN, because it tries to contact a CA. Is there any way around this problem? Regards, Torkel

1 0

rlm_counter location needed in freeradius
by Rupesh Amatya 17 Feb '06

17 Feb '06

where can i find rlm_counter in freeradius?? can anyone suggest me? rupesh Your Name -------- Original Message -------- ==> From: "Alan DeKok" <aland(a)ox.org> ==> Date: Thu, 16 Feb 2006 11:21:38 -0500 "Rupesh Amatya" <rupesh.amatya(a)info.com.np> wrote: > If I put 4hours in Session time and after using 3 hours , if he > disconnects and then reconnects, he can again use 4 hours. > Is there a way that he can no more log in after he uses 4 hours/day ? rlm_counter. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

FATAL! Server is too busy to process requests
by Mitchell, Michael J 17 Feb '06

17 Feb '06

Hi all, I'm at a bit of a loss. I'm currently trying to load test the authentication proxy performance of freeRADIUS 1.0.1 in preparation for a deployment this weekend. Unfortunately, I'm running into this error "Error: FATAL! Server is too busy to process requests". My scenario is: Authentication Request comes in, we look the username up in openLDAP running on the same server, and if the user doesn't exist, proxy the request by setting Proxy-To-Realm using the attribute rewrite module. I have made changes to the rlm_ldap module for local requirements, and also running a couple of custom modules, so its not pure 1.0.1. The error still occurs when I disable all of my custom modules (except rlm_ldap of course). Interestingly, this error doesn't seem to occur when the openLDAP server is running on a different server, however the rate of requests that I can push through the server is also a lot less in this circumstance (about 25%). Oh, and finally, this is running Solaris 9 on a V240. >From what I can tell, it doesn't seem to be related to thread starvation, and the time it takes to reach this error seems to be somewhat variable. The CPU (according to prstat) doesn't need to be at 100% for this to occur either. However typically when it does occur radiusd is using all or close to all of one of the CPU's. It also doesn't happen when I run the server with -xx. Presumably this is because the extra output slows the server down enough such that its not hitting whatever barrier is causing this. To do the testing I'm using radclient sending using multiple threads. The number of radclient threads does seem to have a bearing, and I can stop the error from happening by reducing the number of threads. Once again I presume this is due to the reduced throughput or requests. I've just worked 11 days straight and averaged at least 15 hours a day, and at the moment I'm just too tired to trace right through the code to see what might be causing the issue. It is 3am here after all. Any advice or help is really appreciated at this stage. What might be the cause of (*request)->child_pid != NO_SUCH_CHILD_PID in request_dequeue? Anything I should look at, or tune to reduce the likelyhood of this occurring? It seems that I can also resolve the issue (at least for the same requests rate) by looping at the "select" in requests_dequeue 20 times instead of 10. What risk does this present? I then get errors like: Fri Feb 17 03:10:54 2006 : Error: Dropping conflicting packet from client dbst1:63628 - ID: 198 due to unfinished request 44357 Which is better (to me) than the server stopping. ;-) Thankyou kindly for your time to read this email. Sorry it was so long winded. Hopefully you will be able to offer some advice! kind regards, Mike

3 2

dictionary.cablelabs[168]: dict_addvalue: value name too long
by Ryan Melendez 16 Feb '06

16 Feb '06

Hello, In order to correctly link to libssl.so.0.9.7 and libcrypto.so.0.9.7 at run time. I set LDFLAGS="-R/usr/local/openssl-0.9.7/lib" at compile time. When I execute the bin I get the following error: Thu Feb 16 18:39:40 2006 : Debug: read_config_files: reading dictionary Thu Feb 16 18:39:40 2006 : Error: Errors reading dictionary: dict_init: //usr/local/share/freeradius/dictionary.cablelabs[168]: dict_addvalue: value name too long Thu Feb 16 18:39:40 2006 : Error: Errors reading radiusd.conf If I remove line 168 in the cablelabs dictionary file everything loads fine: Thu Feb 16 18:43:14 2006 : Debug: security: reject_delay = 1 Thu Feb 16 18:43:14 2006 : Debug: security: status_server = no Thu Feb 16 18:43:14 2006 : Debug: main: debug_level = 0 Thu Feb 16 18:43:14 2006 : Debug: read_config_files: reading dictionary Thu Feb 16 18:43:14 2006 : Debug: read_config_files: reading naslist Thu Feb 16 18:43:14 2006 : Debug: read_config_files: reading clients This is the line I removed. dictionary.cablelabs[168] VALUE CableLabs-QoS-Release-Reason Inactivity-Resource-Recovery-Timer-Expiration 2 Alternativly, if I do not set LDFLAGS when I compile and set LD_LIBRARY_PATH at runtime (which I don't want to do) I do not get an error. Am I doing something wrong or is the dictionary file malformed? Please let me know if I can provide any other information. Thanks, Ryan

2 3

Re: Freeradius 1.1.0 and rlm_ldap
by Mark Martinec 16 Feb '06

16 Feb '06

>From futhwo on Thu, 02 Feb 2006: > ... All worked fine untill i upgraded FreeRADIUS form 1.0.5 to 1.1.0. > From there on i cannot authenticate because the Auth-Type attribute is no more valorized to LDAP by the ldap module during authorize section. > ... > rlm_ldap: ldap_release_conn: Release Id: 0 > modcall[authorize]: module "ldap" returns ok for request 0 > modcall: leaving group authorize (returns ok) for request 0 > auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user > ... > So if the Auth-Type LDAP is no more defined,how can i perform authentication against a LDAP server? I noticed the same symptoms after upgrading 1.0.5 to 1.1.0. Somehow the Auth-Type no longer had a value that would match the Auth-Type LDAP {...} entry in the authenticate section, even though the rlm_ldap successfully completed authorization. ChangeLog didn't mention incompatibilities, debug log with -X wasn't helpful, bug database turned out nothing, and mailing list archive turned up similar futhwo's problem report with no replies. Digging on rlm_ldap source and adding some debug printouts revealed that the Auth-Type wasn't left undefined like the debug message lead me to believe, but its value became the name of a LDAP instance (I'm using two LDAP servers in redundant radius group), which did not match the name of the Auth-Type LDAP {} authenticate section. In my case the solution was to replace the: authenticate { ... Auth-Type LDAP {...} with: authenticate { ... Auth-Type ldap-instance1 { ldap-instance1 } Auth-Type ldap-instance2 { ldap-instance2 } I would guess that futhwo's problem has a similar solution, perhaps replacing Auth-Type LDAP with Auth-Type ldap or giving a name to an instance and using that in the authenticate section. It would be helpful to document explicitly what comments in rlm_ldap.c indicate: * Module should default to LDAP authentication if no Auth-Type * specified. Note that we do this ONLY if configured, AND we * set the Auth-Type to our module name, which allows multiple * ldap instances to work. It wouldn't hurt if the inst->set_auth_type = 0 would be accompanied with a debug log entry, and if the pairadd in: if (inst->set_auth_type && (pairfind(*check_pairs, PW_AUTH_TYPE) == NULL) && request->password && (request->password->attribute == PW_USER_PASSWORD)) pairadd(check_pairs, pairmake("Auth-Type", inst->xlat_name, T_OP_EQ)); would also log the inst->xlat_name. But above all, please document incompatibilities between versions. Mark

3 2

Can I proxy by PPPoE service name?
by Zach T Hall 16 Feb '06

16 Feb '06

It seems that the features says it can be done, but I have no idea how. Basically I'm just wondering if I can take the service-name of the PPPoE server and have freeradius proxy out depending on which service name. Does anybody have any suggestions on where I might start looking for information on doing this type of thing? Thanks, Zach Hall

2 1