- Freeradius-Users - lists.freeradius.org

radiusd core dumps on authentication (solaris 9)
by Johan Ramm-Ericson 29 Dec '05

29 Dec '05

Hello freeradius-users! I am currently experiencing an authentication problem and am wondering if anyone has run into something similar (or has an answer as to what I'm doing wrong I am running freeradius 1.0.5 on a Solaris 9 box. I have my users accounts currently stored in a NIS/YP database hosted by a Linux (Suse SLES9) server. My users - configuration file - currently looks like this: DEFAULT Auth-Type = Pam Fall-Through = No I have tried using Auth-Type = {System | Pam | unix}. No matter which I try radiusd core dumps as soon as it comes to the Authenticate module (see debug log below). This does not happen if I set Auth-Type = Local, then everything works as expected. _But_ that would give me two username / password databases to maintain - which is not something I look forward to.... Anyone have any ideas as to what's going on? TIA, Johan PS. No idea if this helps but I have an old freeraidius 1.0.2 lying around. The results (using the same config files) are the same. debug log --------------- /etc/init/freeradiusd start .... Module: Instantiated realm (MIP02) realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (NULL) detail: detailfile = "/opt/freeradius/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/opt/freeradius/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) detail: detailfile = "/opt/freeradius/var/log/radius/radacct/detail-combined" detail: detailperm = 384 detail: dirperm = 493 detail: locking = yes Module: Instantiated detail (accounting_replication_log) detail: detailfile = "/opt/freeradius/var/log/radius/radacct/%{Client-IP-Address}/pre-proxy-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (pre_proxy_log) detail: detailfile = "/opt/freeradius/var/log/radius/radacct/%{Client-IP-Address}/post-proxy-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (post_proxy_log) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) detail: detailfile = "/opt/freeradius/var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (reply_log) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.11.249:3644, id=171, length=121 NAS-IP-Address = 192.168.11.249 NAS-Identifier = "vrr_ggsn_2" Called-Station-Id = "xxxx.xxx.xx" Service-Type = Framed-User Framed-Protocol = GPRS-PDP-Context NAS-Port-Type = Virtual User-Name = "daniel" User-Password = "secret" Calling-Station-Id = "00001111" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/opt/freeradius/var/log/radius/radacct/192.168.11.249/auth-detail-20051229' rlm_detail: /opt/freeradius/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /opt/freeradius/var/log/radius/radacct/192.168.11.249/auth-detail-20051229 modcall[authorize]: module "auth_log" returns ok for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type Pam auth: type "PAM" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 pam_pass: using pamauth string <radiusd> for pam.conf lookup Segmentation Fault - core dumped radiusd

2 1

Freeradius vs NT Domain Authentication
by Richard Bortolucci 29 Dec '05

29 Dec '05

Hi, I know that's possible to configure Freeradius to authenticate Windows NT Domain users, but I just can't find a good/complete documentation about it... Is it possible for anyone on this forum to provide such documentation (files/links/instructions) to me? Thanks, -- Richard Bortolucci

2 3

Client authenticated but no internet connection
by mfred 29 Dec '05

29 Dec '05

Hi, The clients can login (through chillispot login page) and authenticate via the radius server and mysqldb. So they have an IP like 192.168.182.5. But even if they get authenticated they still cannot connect to the internet. And I have no idea why. Any hints ? TIA mfred

5 4

RE: FreeRadius and Dlink Switch Authentication Problem
by Kai Geek 29 Dec '05

29 Dec '05

Merhabalar Inci hanim, oncelikle yardimlariniz icin cok tesekkur ederim. Ancak tacacs kullanamiyoruz cunku switchlerin cogu Dlink ve 3226 modeli yani tacacs yok. radius server destekliyorlar. bu nedenle radius kullanmam gerek. #radiusd -X diyerek debug moda aliyorum ve benim ip adresim 10.0.0.185 radius server ise 10.0.0.6'da calisiyor. switch ise (dlink marka) 10.0.0.250 ip adresine sahip. ben #telnet 10.0.0.250 komutunu verdigim zaman switchin kendi icindeki kullanici ile (admin) girebiliyorum. ama hicbir log dusmuyor. ne onerirsiniz? ----- Original Message ----- From: "Inci Gedik " <igedik(a)ford.com.tr> To: "'FreeRadius users mailing list'" <freeradius-users(a)lists.freeradius.org> Subject: RE: FreeRadius and Dlink Switch Authentication Problem Date: Thu, 29 Dec 2005 15:20:43 +0200 > > Selam, > > Radius un debug ettin mi ? Sen switch e baglanmaya calisirken ekrana neler > geliyor bir bakar misin ? Birde calisan bir sistemden ornek veriim : > > client.conf dosyani asagidaki gibi editler misin ? > > client 10.0.0.250 { > secret = 250 > shortname = switch > nastype = cisco > } > > Users dosyasindaki kulanici tanimlamasini asagidaki gibi yapip, linux > sisteminde steve diye bir kullanici acip bir de sifre verirsen baglantiyi > saglayabilirsin. > > steve Auth-Type := System > Service-Type = Shell-User, > Login-Service = Telnet, > Login-IP-Host = 0.0.0.0, > Login-TCP-Port = Telnet > > Linux altinda port numaralarinda acik degil mi ? Bu sekilde bir kontrol > edersen bir de conf dosyani inceleyebiliriz. O zaman conf dosyanda bir hata > var demektir. > > Bi de israrla tacacs+ diyorum : ) > > > > Kolay gelsin , > > Inci Gedik > > -----Original Message----- > From: freeradius-users-bounces+igedik=ford.com.tr(a)lists.freeradius.org > [mailto:freeradius-users-bounces+igedik=ford.com.tr@lists.freeradius.org] On > Behalf Of Kai Geek > Sent: 29 Aralık 2005 Perşembe 14:24 > To: freeradius-users(a)lists.freeradius.org > Subject: FreeRadius and Dlink Switch Authentication Problem > > Hello, > i am using freeradius in my computer with the ip 10.0.0.6 > i have a dlink 3226s model switch in my network and its ip is 10.0.0.250 > > i want this switch to verify username and password from radius server > (10.0.0.6) > > i have added 10.0.0.250 as a client to the radius servers clients.conf and > users files and i introduced a user. but still it doesnt connect. where may > be the error? > when i test locally, it seems as working but teh switch doesnt connect to > radius? > thank you, > > using command radius server (10.0.0.6) > > kernel@debian#pico clients.conf > > client 10.0.0.250 { > secret = 250 > shortname = 1 > } > > kernel@debian#pico users > > steve Auth-Type := Local, User-Password == "testing" > Service-Type = Framed-User, > Framed-Protocol = PPP, > Framed-IP-Address = 127.0.0.1, > Framed-IP-Netmask = 255.255.255.0, > Framed-Routing = Broadcast-Listen, > Framed-Filter-Id = "std.ppp", > Framed-MTU = 1500, > Framed-Compression = Van-Jacobsen-TCP-IP > > #radtest steve testing 10.0.0.6 1812 testing > okay > what problem ? > when i test locally, it seems as working but teh switch doesnt connect to > radius? > > +-+-+-+ BEGIN PGP SIGNATURE +-+-+-+ > Version: GnuPG v1.4.2 (GNU/Linux) > .-. .-. _ > : : : : :_; > .-' : .--. : `-. .-. .--. ,-.,-. > ' .; :' '_.'' .; :: :' .; ; : ,. : > `.__.'`.__.'`.__.':_;`.__,_;:_;:_; > > Kai "Ozgur" Geek > Network Engineer > PGP ID: B1B63B6E > +-+-+-+ END PGP SIGNATURE +-+-+-+ > > > -- > _______________________________________________ > Check out the latest SMS services @ http://www.linuxmail.org > This allows you to send and receive SMS through your mailbox. > > Powered by Outblaze > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html +-+-+-+ BEGIN PGP SIGNATURE +-+-+-+ Version: GnuPG v1.4.2 (GNU/Linux) .-. .-. _ : : : : :_; .-' : .--. : `-. .-. .--. ,-.,-. ' .; :' '_.'' .; :: :' .; ; : ,. : `.__.'`.__.'`.__.':_;`.__,_;:_;:_; Kai "Ozgur" Geek Network Engineer PGP ID: B1B63B6E +-+-+-+ END PGP SIGNATURE +-+-+-+ -- _______________________________________________ Check out the latest SMS services @ http://www.linuxmail.org This allows you to send and receive SMS through your mailbox. Powered by Outblaze

2 1

FreeRadius and Dlink Switch Authentication Problem
by Kai Geek 29 Dec '05

29 Dec '05

Hello, i am using freeradius in my computer with the ip 10.0.0.6 i have a dlink 3226s model switch in my network and its ip is 10.0.0.250 i want this switch to verify username and password from radius server (10.0.0.6) i have added 10.0.0.250 as a client to the radius servers clients.conf and users files and i introduced a user. but still it doesnt connect. where may be the error? when i test locally, it seems as working but teh switch doesnt connect to radius? thank you, using command radius server (10.0.0.6) kernel@debian#pico clients.conf client 10.0.0.250 { secret = 250 shortname = 1 } kernel@debian#pico users steve Auth-Type := Local, User-Password == "testing" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 127.0.0.1, Framed-IP-Netmask = 255.255.255.0, Framed-Routing = Broadcast-Listen, Framed-Filter-Id = "std.ppp", Framed-MTU = 1500, Framed-Compression = Van-Jacobsen-TCP-IP #radtest steve testing 10.0.0.6 1812 testing okay what problem ? when i test locally, it seems as working but teh switch doesnt connect to radius? +-+-+-+ BEGIN PGP SIGNATURE +-+-+-+ Version: GnuPG v1.4.2 (GNU/Linux) .-. .-. _ : : : : :_; .-' : .--. : `-. .-. .--. ,-.,-. ' .; :' '_.'' .; :: :' .; ; : ,. : `.__.'`.__.'`.__.':_;`.__,_;:_;:_; Kai "Ozgur" Geek Network Engineer PGP ID: B1B63B6E +-+-+-+ END PGP SIGNATURE +-+-+-+ -- _______________________________________________ Check out the latest SMS services @ http://www.linuxmail.org This allows you to send and receive SMS through your mailbox. Powered by Outblaze

3 2

openssl fails
by pelusa vali 29 Dec '05

29 Dec '05

hi everybody, well finally get install openssl v0.9.8a, now when i try to generate certificates to be used with freeradius (eap-tls or eap-peap) i use these command to CERTIFICATE AUTHORITY GENERATION: #openssl req -new -x509 -keyout newreq.pem -out newreq.pem -passin pass:clue1 -passout pass:clue1 #openssl pkcs12 -export -in demoCA/cacert.pem -inkey newreq.pem -out root.p12 -cacerts -passin pass:clue1 -passout pass:clue1 #openssl pkcs12 -in root.p12 -out root.pem -passin pass:clue1 -passout pass:clue1 (i copied root.p12 from freeradius files) #openssl x509 -inform PEM -outform DER -in root.pem -out root.der #rm -rf newreq.pem and these to SERVER CERTIFICATE GENERATION: #openssl req -new -keyout newreq.pem -out newreq.pem -passin pass:whatever -passout pass:clue1 #openssl ca -policy policy_anything -out newcert.pem -passin pass:whatever -key whatever -extensions xpserver_ext -extfile xpextensions -infiles newreq.pem right here, when using this command i get this error: Error opening CA private key ./demoCA/private/cakey.pem 4161:error:02001002:system library:fopen:No such file or directory:bss_file.c:349:fopen ('./demoCA/private/cakey.pem' ,'r') 4161:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:351: unable to load CA private key well i really don't understand what this mean but reviewed ./demoCA/private/cakey.pem and effectively it's there, so why openssl cann't locate it?? why unable to load CA private key?? so, i tried this: #openssl x509 -inform PEM -outform DER -in demoCA/cacert.pem -out demoCA/cacert.der but now get this: 4201:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:644:Expecting: TRUSTED CERTIFICATE excuse if this question is so trivial but i really don't understand it. could any body help and tell me what is happening?? thanks for your patience and help. _________________________________________________________________ Las mejores tiendas, los precios mas bajos, entregas en todo el mundo, YupiMSN Compras: http://latam.msn.com/compras/

2 1

Re:no response from server on other machine
by yao guoxian 29 Dec '05

29 Dec '05

> If the server doesn't respond on localhost, then either it isn't >running, or you edited the configuration files to break it. > Alan DeKok. Thank you for your suggestion. The fact is Radius works correctly on the localmachine (the same machine on which FreeRadius 1.0.5 was installed).However, when a authentication request was sent to Radius Server from the other machine. The request got no response. I don't know the reason. Can you give me a detail on how to resovle the problem?

4 3

Selecting one of multiple Ldap server in users file
by Gerald Richter 29 Dec '05

29 Dec '05

Hi, I want to use more than one ldap server to authenticate users. I have setup a users file that sets the Autz-Type so one of two ldap server are selected for authorization. Since it is not known which kind of authentication information is provied by the user, chap is also included, like Authorize { preprocess suffix file Auth-Type aldap1 { chap ldap1 } Auth-Type aldap2 { chap ldap2 } } My problem is now when it comes the authentication, because both instances of the ldap module sets the Auth-Type to LDAP, it will only work with one ldap server. Also I cannot set the Auth-Type in the users file, because it might also be set to CHAP by the chap module. How can I specify which ldap server to use for authentication in such a case? Is there a possibility to include the module instance name in the Auth-Type? Thanks Gerald --------------------------------------------------------------------------- Gerald Richter ecos electronic communication services gmbh IT-Securitylösungen * Webapplikationen mit Apache/Perl/mod_perl/Embperl Post: Tulpenstrasse 5 D-55276 Dienheim b. Mainz E-Mail: richter(a)ecos.de Voice: +49 6133 939-122 WWW: http://www.ecos.de/ Fax: +49 6133 939-333 --------------------------------------------------------------------------- ECOS BB-5000 Firewall- und IT-Security Appliance: www.bb-5000.info --------------------------------------------------------------------------- ** Virus checked by BB-5000 Mailfilter **

3 6

Adapting Reply-Msg to Reject cause
by Yannick Deltroo 28 Dec '05

28 Dec '05

Hello, I'm using Freeradius with rlm_sql & sqlcounter to authorize access to hotspots. I would like to set a specific Reply-Message (which is displayed in the user browser) depending the Reject cause, for instance: - Reply-Msg="Account has expired" (if reject because of Expiration == XXXX) - Reply-Msg="Time credit is exhausted" (if reject because of Max-All-Session := XXXX) - Reply-Msg="Access not allowed from this NAS" (if reject because of Nas-Identifier !=XXXX) - Reply-Msg="Wrong password" (if cannot authenticate) How can I do that without writing a custom authorization script ? Thanks for yout help. Yannick Deltroo

1 0

AcctStopTime - AccStartTime != AcctSessionTime
by Ezequiel O. Block 28 Dec '05

28 Dec '05

Hi to all, +----------+---------------------+---------------------+-----------------+ | UserName | AcctStartTime | AcctStopTime | AcctSessionTime | +----------+---------------------+---------------------+-----------------+ | pepe | 2005-12-02 16:24:45 | 2005-12-02 16:25:46 | 63 | | pepe | 2005-12-02 16:26:23 | 2005-12-02 16:27:12 | 52 | | pepe | 2005-12-02 16:29:02 | 2005-12-02 16:29:09 | 9 | | pepe | 2005-12-02 17:43:37 | 2005-12-02 18:03:32 | 1197 | | pepe | 2005-12-02 18:09:16 | 2005-12-02 18:15:45 | 391 | First line should be 61 Second line should be 49 Third line should be 7 etc. In some rows there are even bigger differences, shouldn´t be AcctSessionTime the difference of AcctStopTime - AcctStartTime ? Thanks in advance, Ezequiel. -- Ezequiel O. Block Cooperativa La Lonja, Servicios de Internet. T 02322-474537 F 02322-470406 E ezequielb(a)pilar-ciudad.com.ar

2 1