- Freeradius-Users - lists.freeradius.org

Re: Problem with Password and MySQL
by Fabio 27 Oct '05

27 Oct '05

Hi, I discovered where was the error: I was also limiting the users that can access at the database using the field "NAS-Identifier". That field was copied in the internal tunnell using "copy_request_to_tunnel = yes" in ttls, but not in PEAP. ========================================== To the developer: ========================================== Please document the option "copy_request_to_tunnel" in the peap module in eap.conf. I see it is supported but not documented as in the ttls module. Thanks. ========================================== > What kind of password have you stored in your db? > Alseo the "upper" part of debug info is relevant. Could you post it? > Yuri > > > On 10/25/05, Fabio <fabio.ped(a)libero.it> wrote: > > > > Hi, > > I am trying to use MySQL to autenticate users of a wireless network, using > > EAP-TTLS-PAP or PEAP-MS-CHAPv2. > > > > I use the following users file: > > > > user1 User-Password == "user1" > > DEFAULT Suffix == "@mydomain.org <http://mydomain.org>", Autz-Type := SQL > > > > while I have the following user in radcheck in MySQL > > > > mysql> select * from radcheck; > > +----+----------+---------------+----+-------+ > > | id | UserName | Attribute | op | Value | > > +----+----------+---------------+----+-------+ > > | 11 | sql1 | User-Password | == | sql1 | > > +----+----------+---------------+----+-------+ > > 1 row in set (0.00 sec) > > > > Logging with the user "user1" work fo both TTLS-PAP and PEAP-MS-CHAP-V2 > > (Tested with wpa_supplicant (both TTLS and PEAP) and MS Windows XP (PEAP)). > > > > When i try to authenticate as the user sql1 (which is in the MySQL DB), > > works for TTLS-PAP but doesn't work with PEAP. Seems that inside the file > > "users" are handled both PAP and MS-CHAPv2 password, while with MySQL I can > > use only PAP. > > > > The relevant part of the log with radiusd -X is provided below. > > > > Thanks to anyone helping with this. > > > > > > auth: type "EAP" > > Processing the authenticate section of radiusd.conf > > modcall: entering group authenticate for request 8 > > rlm_eap: Request found, released from the list > > rlm_eap: EAP/peap > > rlm_eap: processing type peap > > rlm_eap_peap: Authenticate > > rlm_eap_tls: processing TLS > > eaptls_verify returned 7 > > rlm_eap_tls: Done initial handshake > > eaptls_process returned 7 > > rlm_eap_peap: EAPTLS_OK > > rlm_eap_peap: Session established. Decoding tunneled attributes. > > rlm_eap_peap: Received EAP-TLV response. > > rlm_eap_peap: Tunneled data is valid. > > rlm_eap_peap: Had sent TLV failure, rejecting. > > rlm_eap: Handler failed in EAP/peap > > rlm_eap: Failed in EAP select > > modcall[authenticate]: module "eap" returns invalid for request 8 > > modcall: group authenticate returns invalid for request 8 > > auth: Failed to validate the user. > > > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > > > -- > Yuri Francalacci > yuri.francalacci(a)gmail.com >

1 0

Execute script to enable rlm counter module
by freeradius 27 Oct '05

27 Oct '05

Hello, I want to execute a script in the authentication process that simulates accounting with radclient so that the counter module starts measuring time. But I do not know what data freeradius expects to start counting. The whole story with debug info: Currently I write a diploma involving a freeradius server. The platform is debian and windows xp (cygwin compiled version of freeradius -> nearly identical configuration). I create useraccounts dynamically and I load them through fastusers. So no SQL is involved (does not work in the win32 version). I want to disable a user account 60 minutes after he uses the account to authenticate on the radius server through eap-md5. The authentication part works fine with the client. The calculation of the session time with daily counter does not work. I suppose because the NAS does not support radius accounting. And with my understanding of the manual and various posts to this mailinglist it is mandatory to get the counter working. I use the standard radius configfile and I have uncommented the counter daily in the appropriate sections in raddb.conf. In users I have implemented the DEFAULT rule to reject 60 minutes after first use. DEFAULT Daily-Session-Time > 3600, Auth-Type = Reject Reply-Message = "You've used up more than one hour today" According to the debug information the counter is correctly instantiated: Module: Loaded Counter counter: filename = "../etc/raddb/db.daily" counter: key = "User-Name" counter: reset = "monthly" counter: count-attribute = "Acct-Session-Time" counter: counter-name = "Daily-Session-Time" counter: check-name = "Max-Daily-Session" counter: allowed-servicetype = "(null)" counter: cache-size = 5000 rlm_counter: Counter attribute Daily-Session-Time is number 1671 rlm_counter: Current Time: 1130410681 [2005-10-27 12:58:01], Next reset 11307960 00 [2005-10-31 23:00:00] Module: Instantiated counter (daily) freeradius is listening: Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. When a user logs in the counter returns: rlm_counter: Entering module authorize code rlm_counter: Could not find Check item value pair modcall[authorize]: module "daily" returns noop for request 0 There is the accounting database db.daily with ~4kb binary data. I suppose that there is no accounting data in it and so the counter could not check the item value pair. The counter module daily does not begin accounting because the user only authorizes himself and it could be possible that he does not use the service. ---> So I want to trick freeradius with fake accounting data. I want to execute a script in the authentication process that simulates accounting with the radclient. I managed to execute a script to start radclient. But I do not know what data is needed so that freeradius really thinks that the user uses his account. If I send an the standard test accounting packet with radclient I receive this: Nothing to do. Sleeping until we see a request. rad_recv: Accounting-Request packet from host 127.0.0.1:1846, id=48, length=60 User-Name = "John Doe" User-Password = "\203\373\033%bk82\356\250\227\016\005\031\375\023" NAS-IP-Address = 127.0.0.1 NAS-Port = 123 Processing the preacct section of radiusd.conf modcall: entering group preacct for request 1 modcall[preacct]: module "preprocess" returns noop for request 1 rlm_acct_unique: WARNING: Attribute Acct-Session-Id was not found in request, un ique ID MAY be inconsistent rlm_acct_unique: Hashing 'NAS-Port = 123,Client-IP-Address = 127.0.0.1,NAS-IP-Ad dress = 127.0.0.1,,User-Name = "John Doe"' rlm_acct_unique: Acct-Unique-Session-ID = "40560ac3fd77d64a". modcall[preacct]: module "acct_unique" returns ok for request 1 rlm_realm: No '@' in User-Name = "John Doe", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 1 modcall[preacct]: module "files" returns noop for request 1 modcall: group preacct returns ok for request 1 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 1 radius_xlat: '../var/log/radius/radacct/127.0.0.1/detail-20051027' rlm_detail: ../var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to ../var/log/radius/radacct/127.0.0.1/detail-20051027 modcall[accounting]: module "detail" returns ok for request 1 rlm_counter: Could not find account status type in packet. modcall[accounting]: module "daily" returns noop for request 1 rlm_unix: no Accounting-Status-Type attribute in request. modcall[accounting]: module "unix" returns noop for request 1 rlm_radutmp: No Accounting-Status-Type record. modcall[accounting]: module "radutmp" returns noop for request 1 modcall: group accounting returns ok for request 1 Sending Accounting-Response of id 48 to 127.0.0.1:1846 Finished request 1 Going to the next request --- Walking the entire request list --- Cleaning up request 1 ID 48 with timestamp 4360b4e1 Nothing to do. Sleeping until we see a request. So what is the appropriate data to feed to freeradius so that the time will be measured? Can someone help me in this matter? Thanks you for your patience reading this and for your suggestions, Reiner Rottmann.

1 0

Freeradius stops authenticating
by Svein Hansen 27 Oct '05

27 Oct '05

I have a Cisco VPN 3000 Concentrator and a Trapeze Wireless Mobility Exchange(MX-400) that authenticate users in Freeradius by using MSChapV2 and smbpasswd. My radius stops authenticating approx. 2 times a day. The pid usually dies, but sometimes it lives (but not authenticating). I followed the instructions on the BUG page, and got a core dump: (gdb) bt #0 0x0017f7a2 in _dl_sysinfo_int80 () from /lib/ld-linux.so.2 #1 0x0040e7d5 in raise () from /lib/tls/libc.so.6 #2 0x00410149 in abort () from /lib/tls/libc.so.6 #3 0x0044227a in __libc_message () from /lib/tls/libc.so.6 #4 0x00448abf in _int_free () from /lib/tls/libc.so.6 #5 0x00448e3a in free () from /lib/tls/libc.so.6 #6 0x00439366 in fclose@@GLIBC_2.1 () from /lib/tls/libc.so.6 #7 0x00f24de1 in get_next (name=0x9d69ffc "tonemere", ht=0x9d65e70) at rlm_passwd.c:280 #8 0x00f25c21 in passwd_authorize (instance=0x9d65db0, request=0xb7e00858) at rlm_passwd.c:540 #9 0x003d7c54 in modcall (component=1, c=0x9d65030, request=0xb7e00858) at modcall.c:219 #10 0x003d7ee1 in modcall (component=1, c=0x9d642e8, request=0xb7e00858) at modcall.c:252 #11 0x003d7126 in indexed_modcall (comp=1, idx=6, request=0x0) at modules.c:473 #12 0x003d3ef3 in rad_authenticate (request=0xb7e00858) at auth.c:592 #13 0x003cd04c in rad_respond (request=0xb7e00858, fun=0x3d3e57 <rad_authenticate>) at radiusd.c:1642 #14 0x003da481 in request_handler_thread (arg=0x9d68728) at threads.c:517 #15 0x0095e341 in start_thread () from /lib/tls/libpthread.so.0 #16 0x004adfee in clone () from /lib/tls/libc.so.6 (gdb) As I understand of this printout, it's glibc that faults.. I suspected that there had to be a module in freeradius that makes glibc fault, so I tried to run freeradius in Valgrind: [root@eva etc]# valgrind -v --tool=memcheck radiusd -yf ==5070== Memcheck, a memory error detector for x86-linux. ==5070== Copyright (C) 2002-2004, and GNU GPL'd, by Julian Seward et al. ==5070== Using valgrind-2.2.0, a program supervision framework for x86-linux. ==5070== Copyright (C) 2000-2004, and GNU GPL'd, by Julian Seward et al. ==5070== Valgrind library directory: /usr/lib/valgrind ==5070== Command line ==5070== radiusd ==5070== -yf ==5070== Startup, with flags: ==5070== -v ==5070== --tool=memcheck ==5070== Contents of /proc/version: ==5070== Linux version 2.6.9-11.ELsmp (bhcompile(a)decompose.build.redhat.com) (gcc version 3.4.3 20050227 (Red Hat 3.4.3-18:26:27 EDT 2005 ==5070== Reading syms from /usr/sbin/radiusd (0x0) ==5070== object doesn't have a symbol table ==5070== Reading syms from /lib/ld-2.3.4.so (0x1B8E4000) ==5070== object doesn't have any debug info ==5070== Reading syms from /usr/lib/valgrind/stage2 (0xB0000000) ==5070== Reading syms from /lib/ld-2.3.4.so (0xB1000000) ==5070== object doesn't have any debug info ==5070== Reading syms from /usr/lib/valgrind/vgskin_memcheck.so (0xB7C8C000) ==5070== Reading syms from /lib/tls/libc-2.3.4.so (0xB7EB5000) ==5070== object doesn't have any debug info ==5070== Reading syms from /lib/libdl-2.3.4.so (0xB7FDF000) ==5070== object doesn't have any debug info ==5070== Reading suppressions file: /usr/lib/valgrind/default.supp ==5070== REDIRECT soname:libc.so.6(__GI___errno_location) to soname:libpthread.so.0(__errno_location) ==5070== REDIRECT soname:libc.so.6(__errno_location) to soname:libpthread.so.0(__errno_location) ==5070== REDIRECT soname:libc.so.6(__GI___h_errno_location) to soname:libpthread.so.0(__h_errno_location) ==5070== REDIRECT soname:libc.so.6(__h_errno_location) to soname:libpthread.so.0(__h_errno_location) ==5070== REDIRECT soname:libc.so.6(__GI___res_state) to soname:libpthread.so.0(__res_state) ==5070== REDIRECT soname:libc.so.6(__res_state) to soname:libpthread.so.0(__res_state) ==5070== REDIRECT soname:libc.so.6(stpcpy) to *vgpreload_memcheck.so*(stpcpy) ==5070== REDIRECT soname:libc.so.6(strnlen) to *vgpreload_memcheck.so*(strnlen) ==5070== REDIRECT soname:ld-linux.so.2(stpcpy) to *vgpreload_memcheck.so*(stpcpy) ==5070== REDIRECT soname:ld-linux.so.2(strchr) to *vgpreload_memcheck.so*(strchr) ==5070== ==5070== Reading syms from /usr/lib/valgrind/vg_inject.so (0x1B8FC000) ==5070== Reading syms from /usr/lib/valgrind/vgpreload_memcheck.so (0x1B901000) ==5070== TRANSLATE: 0x1B8F5EE0 redirected to 0x1B904100 ==5070== Reading syms from /lib/libcrypt-2.3.4.so (0x8D2000) ==5070== object doesn't have any debug info ==5070== Reading syms from /lib/libssl.so.0.9.7a (0x3AB000) ==5070== object doesn't have a symbol table ==5070== object doesn't have any debug info ==5070== Reading syms from /lib/libcrypto.so.0.9.7a (0x644000) ==5070== object doesn't have a symbol table ==5070== object doesn't have any debug info ==5070== Reading syms from /lib/libnsl-2.3.4.so (0x8BA000) ==5070== object doesn't have any debug info ==5070== Reading syms from /lib/libresolv-2.3.4.so (0xD8F000) ==5070== object doesn't have any debug info ==5070== Reading syms from /usr/lib/valgrind/libpthread.so (0x1B928000) ==5070== Reading syms from /usr/lib/libradius-1.0.5.so (0x1B957000) ==5070== object doesn't have a symbol table ==5070== Reading syms from /usr/lib/libltdl.so.3.1.0 (0xDA3000) ==5070== object doesn't have a symbol table ==5070== object doesn't have any debug info ==5070== Reading syms from /lib/libdl-2.3.4.so (0xBFD000) ==5070== object doesn't have any debug info ==5070== Reading syms from /lib/tls/libc-2.3.4.so (0xAAD000) ==5070== object doesn't have any debug info ==5070== Reading syms from /usr/lib/libgssapi_krb5.so.2.2 (0x46E000) ==5070== object doesn't have a symbol table ==5070== object doesn't have any debug info ==5070== Reading syms from /usr/lib/libkrb5.so.3.2 (0x304000) ==5070== object doesn't have a symbol table ==5070== object doesn't have any debug info ==5070== Reading syms from /lib/libcom_err.so.2.1 (0x2DC000) ==5070== object doesn't have a symbol table ==5070== object doesn't have any debug info ==5070== Reading syms from /usr/lib/libk5crypto.so.3.0 (0x2E1000) ==5070== object doesn't have a symbol table ==5070== object doesn't have any debug info ==5070== Reading syms from /usr/lib/libz.so.1.2.1.2 (0xC03000) ==5070== object doesn't have a symbol table ==5070== object doesn't have any debug info ==5070== TRANSLATE: 0xB10E80 redirected to 0x1B9048F8 ==5070== TRANSLATE: 0x1B8E47A0 redirected to 0x52BFF040 ==5070== TRANSLATE: 0xB0EDB0 redirected to 0x1B904E24 ==5070== TRANSLATE: 0xB15D20 redirected to 0x1B9042D0 Thu Oct 6 09:11:38 2005 : Info: Starting - reading configuration files ... ==5070== TRANSLATE: 0xB17090 redirected to 0x1B9046F4 ==5070== TRANSLATE: 0xB10BA0 redirected to 0x1B905274 ==5070== Reading syms from /lib/libnss_files-2.3.4.so (0x1B90C000) ==5070== object doesn't have any debug info ==5070== Reading syms from /usr/lib/rlm_expr-1.0.5.so (0x1B918000) ==5070== object doesn't have a symbol table ==5070== Reading syms from /usr/lib/rlm_counter-1.0.5.so (0x1B91B000) ==5070== object doesn't have a symbol table ==5070== Reading syms from /usr/lib/libgdbm.so.2.0.0 (0xBD8000) ==5070== object doesn't have a symbol table ==5070== object doesn't have any debug info ==5070== Reading syms from /usr/lib/rlm_mschap-1.0.5.so (0x1CF87000) ==5070== object doesn't have a symbol table ==5070== Reading syms from /usr/lib/rlm_preprocess-1.0.5.so (0x1B921000) ==5070== object doesn't have a symbol table ==5070== Reading syms from /usr/lib/rlm_realm-1.0.5.so (0x1CF8E000) ==5070== object doesn't have a symbol table ==5070== Reading syms from /usr/lib/rlm_files-1.0.5.so (0x1CF92000) ==5070== object doesn't have a symbol table ==5070== Reading syms from /usr/lib/rlm_passwd-1.0.5.so (0x1CF96000) ==5070== object doesn't have a symbol table ==5070== Reading syms from /usr/lib/rlm_acct_unique-1.0.5.so (0x1CF9B000) ==5070== object doesn't have a symbol table ==5070== Reading syms from /usr/lib/rlm_detail-1.0.5.so (0x1CF9E000) ==5070== object doesn't have a symbol table ==5070== TRANSLATE: 0xB114C0 redirected to 0x1B905326 ==5070== Reading syms from /usr/lib/rlm_radutmp-1.0.5.so (0x1CFA2000) ==5070== object doesn't have a symbol table ==5070== TRANSLATE: 0xB11160 redirected to 0x1B905413 ==5070== warning: Valgrind's pthread_attr_destroy does nothing ==5070== your program may misbehave as a result ==5070== warning: Valgrind's pthread_attr_destroy does nothing ==5070== your program may misbehave as a result ==5070== warning: Valgrind's pthread_attr_destroy does nothing ==5070== your program may misbehave as a result ==5070== Thread 8: ==5070== Invalid read of size 4 ==5070== at 0xAFF2E8: _IO_fclose@@GLIBC_2.1 (in /lib/tls/libc-2.3.4.so) ==5070== by 0x1CF97CC0: ??? (rlm_passwd.c:303) ==5070== by 0xFC53: modcall (modcall.c:219) ==5070== by 0xFEE0: modcall (modcall.c:252) ==5070== Address 0x20C29C6C is 92 bytes inside a block of size 352 free'd ==5070== at 0x1B904EA5: free (vg_replace_malloc.c:153) ==5070== by 0xAFF365: _IO_fclose@@GLIBC_2.1 (in /lib/tls/libc-2.3.4.so) ==5070== by 0x1CF96DE0: ??? (rlm_passwd.c:280) ==5070== by 0x1CF97C20: ??? (rlm_passwd.c:540) ==5070== ==5070== Thread 8: ==5070== Invalid read of size 4 ==5070== at 0xAFF403: _IO_fclose@@GLIBC_2.1 (in /lib/tls/libc-2.3.4.so) ==5070== by 0x1CF97CC0: ??? (rlm_passwd.c:303) ==5070== by 0xFC53: modcall (modcall.c:219) ==5070== by 0xFEE0: modcall (modcall.c:252) ==5070== Address 0x20C29C34 is 36 bytes inside a block of size 352 free'd ==5070== at 0x1B904EA5: free (vg_replace_malloc.c:153) ==5070== by 0xAFF365: _IO_fclose@@GLIBC_2.1 (in /lib/tls/libc-2.3.4.so) ==5070== by 0x1CF96DE0: ??? (rlm_passwd.c:280) ==5070== by 0x1CF97C20: ??? (rlm_passwd.c:540) ==5070== ==5070== Thread 8: ==5070== Invalid write of size 4 ==5070== at 0xAFF358: _IO_fclose@@GLIBC_2.1 (in /lib/tls/libc-2.3.4.so) ==5070== by 0x1CF97CC0: ??? (rlm_passwd.c:303) ==5070== by 0xFC53: modcall (modcall.c:219) ==5070== by 0xFEE0: modcall (modcall.c:252) ==5070== Address 0x20C29C10 is 0 bytes inside a block of size 352 free'd ==5070== at 0x1B904EA5: free (vg_replace_malloc.c:153) ==5070== by 0xAFF365: _IO_fclose@@GLIBC_2.1 (in /lib/tls/libc-2.3.4.so) ==5070== by 0x1CF96DE0: ??? (rlm_passwd.c:280) ==5070== by 0x1CF97C20: ??? (rlm_passwd.c:540) ==5070== ==5070== Thread 8: ==5070== Invalid free() / delete / delete[] ==5070== at 0x1B904EA5: free (vg_replace_malloc.c:153) ==5070== by 0xAFF365: _IO_fclose@@GLIBC_2.1 (in /lib/tls/libc-2.3.4.so) ==5070== by 0x1CF97CC0: ??? (rlm_passwd.c:303) ==5070== by 0xFC53: modcall (modcall.c:219) ==5070== Address 0x20C29C10 is 0 bytes inside a block of size 352 free'd ==5070== at 0x1B904EA5: free (vg_replace_malloc.c:153) ==5070== by 0xAFF365: _IO_fclose@@GLIBC_2.1 (in /lib/tls/libc-2.3.4.so) ==5070== by 0x1CF96DE0: ??? (rlm_passwd.c:280) ==5070== by 0x1CF97C20: ??? (rlm_passwd.c:540) I'm not a programmer, but can it be that radius tries a double-close or a double-free? I have had the same problem on Freeradius 1.0.1, 1.0.4 and 1.0.5. My current conf: rhel 4 Kernel: 2.6.9-22.ELsmp radiusd: FreeRADIUS Version 1.0.5, for host , built on Sep 28 2005 at 09:42:46 glibc-2.3.4-2.13 (Sorry for my bad english..) Svein Hansen

2 1

SV: Authentication problems between Cisco Aironet 1100 and freeradius
by Torkel Mathisen 27 Oct '05

27 Oct '05

Hi I found out what my problem was. Small error in my XP configuration. Regards, Torkel ________________________________ Fra: Torkel Mathisen Sendt: 26. oktober 2005 16:41 Til: 'FreeRadius users mailing list' Emne: Authentication problems between Cisco Aironet 1100 and freeradius Hi I got some problems getting EAP to work with Cisco Aironet 1100 and Freeradius. I've gotten freeradius to work I think and I have configured Cisco Aironet 1100 AP according to Cisco. (http://www.cisco.com/en/US/products/hw/wireless/ps4570/products_configu ration_example09186a00801bd035.shtml) (http://www.cisco.com/en/US/products/hw/wireless/ps4570/products_configu ration_example09186a00801c40b6.shtml#NetEAP) When I try to connect too my WLAN with my testuser. (User: testuser, Password: Secret149) it won't authenticate. I've configured freeradius to use PEAP-MSCHAPv2. Anyone able to help me out? Regards, Torkel This is the log I get when i run radiusd -X: rad_recv: Access-Request packet from host 10.0.0.1:21645, id=65, length=133 User-Name = "testuser" Framed-MTU = 1400 Called-Station-Id = "000e.8401.cd50" Calling-Station-Id = "0011.0a80.41d1" Message-Authenticator = 0x194f32c82aa7088f53cdfc8ac8a36151 EAP-Message = 0x0202000d017465737475736572 NAS-Port-Type = Wireless-802.11 NAS-Port = 478 Service-Type = Framed-User NAS-IP-Address = 10.0.0.1 NAS-Identifier = "testAP" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 63 modcall[authorize]: module "preprocess" returns ok for request 63 modcall[authorize]: module "chap" returns noop for request 63 modcall[authorize]: module "mschap" returns noop for request 63 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 63 rlm_eap: EAP packet type response id 2 length 13 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 63 users: Matched entry testuser at line 90 modcall[authorize]: module "files" returns ok for request 63 modcall: group authorize returns updated for request 63 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 63 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 63 modcall: group authenticate returns handled for request 63 Sending Access-Challenge of id 65 to 10.0.0.1:21645 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x67a4b4a551592fcc14469ef9c70a4601 Finished request 63 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.0.0.1:21645, id=66, length=218 User-Name = "testuser" Framed-MTU = 1400 Called-Station-Id = "000e.8401.cd50" Calling-Station-Id = "0011.0a80.41d1" Message-Authenticator = 0xd5957923efcbfe4c3ee547a066e21d0a EAP-Message = 0x0203005019800000004616030100410100003d0301435f8f34c71e673ecee95256802f 571c6bfa86eaa89728f7d7f782809ef0f82600001600040005000a000900640062000300 060013001200630100 NAS-Port-Type = Wireless-802.11 NAS-Port = 478 State = 0x67a4b4a551592fcc14469ef9c70a4601 Service-Type = Framed-User NAS-IP-Address = 10.0.0.1 NAS-Identifier = "testAP" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 64 modcall[authorize]: module "preprocess" returns ok for request 64 modcall[authorize]: module "chap" returns noop for request 64 modcall[authorize]: module "mschap" returns noop for request 64 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 64 rlm_eap: EAP packet type response id 3 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 64 users: Matched entry testuser at line 90 modcall[authorize]: module "files" returns ok for request 64 modcall: group authorize returns updated for request 64 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 64 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0654], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 64 modcall: group authenticate returns handled for request 64 Sending Access-Challenge of id 66 to 10.0.0.1:21645 EAP-Message = 0x0104040a19c0000006b1160301004a020000460301435f8f1b11c01e5389f06ab78215 4f3759e70cc9bb2b320d320ab9c656d33f6e205816b685a712ff840d91baa1dbf8b9c0ec 209492aecf22425643fafe1541596d00040016030106540b00065000064d0002b3308202 af30820218a003020102020900b646b246bff02a86300d06092a864886f70d0101040500 30818d310b3009060355040613024e4f310d300b060355040813044f534c4f310d300b06 0355040713044f534c4f310f300d060355040a130642425320415331133011060355040b 130a66726565726164697573311b301906035504031312436c69656e7420636572746966 6963 EAP-Message = 0x617465311d301b06092a864886f70d010901160e726f6f74406c6f63616c686f737430 1e170d3035313032363132333432385a170d3036313032363132333432385a30818b310b 3009060355040613024e4f310d300b060355040813044f534c4f310d300b060355040713 044f534c4f310f300d060355040a130642425320415331133011060355040b130a667265 657261646975733119301706035504031310526f6f74206365727469666963617465311d 301b06092a864886f70d010901160e726f6f74406c6f63616c686f737430819f300d0609 2a864886f70d010101050003818d0030818902818100eead5285b5e9f7b939a2dfc1b7fe f60a EAP-Message = 0xbd055de0ba27b2ef81244e0eabad60241727ff5fc724f36147d08ea5f9e3f0110dfb5a 2397c3906a00ab8eb28509e4a672b2c948c0b8007785f550b3908c2f49d7a113d6e7198d 9606e567fc38be816fb2acf60f18bfe56d0617ff7e651439ce9c8ed40363b5b1e4d0d96f 59a468a6650203010001a317301530130603551d25040c300a06082b0601050507030130 0d06092a864886f70d01010405000381810050aa5f1713a5025d21f128094104579eb85a 9ded57072baf72b2c0e3fbea766eb53c62e9bc2a5d1bc22f2615cc1fe88487e2d0b7e5ea a045a8ae1734a85f28e6cd70d3340c2a51bfe7b974c13b9a1a4abebe373312d1d4b987e3 2368 EAP-Message = 0x1edad7e4a54456fd7989e901485e9f2fcf7e8ed8e57fae97fb2fdd1fba5a50c683b7da 7f00039430820390308202f9a003020102020900b646b246bff02a84300d06092a864886 f70d010104050030818d310b3009060355040613024e4f310d300b060355040813044f53 4c4f310d300b060355040713044f534c4f310f300d060355040a13064242532041533113 3011060355040b130a66726565726164697573311b301906035504031312436c69656e74 206365727469666963617465311d301b06092a864886f70d010901160e726f6f74406c6f 63616c686f7374301e170d3035313032363132333432335a170d30373130323631323334 3233 EAP-Message = 0x5a30818d310b3009060355040613024e4f310d300b06 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd8223ab2cc29f1f3ad13843d71797409 Finished request 64 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.0.0.1:21645, id=67, length=144 User-Name = "testuser" Framed-MTU = 1400 Called-Station-Id = "000e.8401.cd50" Calling-Station-Id = "0011.0a80.41d1" Message-Authenticator = 0xcc2b18df4d9f3ad232f1d712d0fefa45 EAP-Message = 0x020400061900 NAS-Port-Type = Wireless-802.11 NAS-Port = 478 State = 0xd8223ab2cc29f1f3ad13843d71797409 Service-Type = Framed-User NAS-IP-Address = 10.0.0.1 NAS-Identifier = "testAP" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 65 modcall[authorize]: module "preprocess" returns ok for request 65 modcall[authorize]: module "chap" returns noop for request 65 modcall[authorize]: module "mschap" returns noop for request 65 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 65 rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 65 users: Matched entry testuser at line 90 modcall[authorize]: module "files" returns ok for request 65 modcall: group authorize returns updated for request 65 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 65 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 65 modcall: group authenticate returns handled for request 65 Sending Access-Challenge of id 67 to 10.0.0.1:21645 EAP-Message = 0x010502b719000355040813044f534c4f310d300b060355040713044f534c4f310f300d 060355040a130642425320415331133011060355040b130a66726565726164697573311b 301906035504031312436c69656e74206365727469666963617465311d301b06092a8648 86f70d010901160e726f6f74406c6f63616c686f737430819f300d06092a864886f70d01 0101050003818d0030818902818100bb9dc7f9a6b879ddde091ded35f3137693d1a9fa9d 2e2f1e20e1e49c9daf077fd1c4066e8e409eda68baac046ff390baedad93e603fdde7304 6df106c9c3775eb0e024a2682faf6469e778758b9c782a11ad0dcc25edca8f9efdee96cc c1bc EAP-Message = 0x84850d853d4435da9ab22ec6c3dc4e6d9137e0ec36d705c923055aa8b900d833350203 010001a381f53081f2301d0603551d0e04160414227f0709429785a3169b9817627cd456 d617f2283081c20603551d230481ba3081b78014227f0709429785a3169b9817627cd456 d617f228a18193a4819030818d310b3009060355040613024e4f310d300b060355040813 044f534c4f310d300b060355040713044f534c4f310f300d060355040a13064242532041 5331133011060355040b130a66726565726164697573311b301906035504031312436c69 656e74206365727469666963617465311d301b06092a864886f70d010901160e726f6f74 406c EAP-Message = 0x6f63616c686f7374820900b646b246bff02a84300c0603551d13040530030101ff300d 06092a864886f70d0101040500038181001fb7ec3488fd3b6349d6cc33b5c6451ce1c2e8 ef8db6f4818cd017991f9649141c1767553c20303e262fec4bb351cda19b403bab78aa37 236ffc78dace1a39089ff037eb911a5133bc6b1f0275cc9e68bc4c8f487a4d2cdc8e7061 34e512d7e715ca81c5a7bb6cc668ca8181e898befeab40773de8f3eb6629ecd2c79d5f74 f116030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6a28407c14613e4bb49a5c41aab60bfd Finished request 65 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.0.0.1:21645, id=68, length=144 User-Name = "testuser" Framed-MTU = 1400 Called-Station-Id = "000e.8401.cd50" Calling-Station-Id = "0011.0a80.41d1" Message-Authenticator = 0x9a39ada2dab238ef570b8dc1dd3f3b6c EAP-Message = 0x020500061900 NAS-Port-Type = Wireless-802.11 NAS-Port = 478 State = 0x6a28407c14613e4bb49a5c41aab60bfd Service-Type = Framed-User NAS-IP-Address = 10.0.0.1 NAS-Identifier = "testAP" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 66 modcall[authorize]: module "preprocess" returns ok for request 66 modcall[authorize]: module "chap" returns noop for request 66 modcall[authorize]: module "mschap" returns noop for request 66 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 66 rlm_eap: EAP packet type response id 5 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 66 users: Matched entry testuser at line 90 modcall[authorize]: module "files" returns ok for request 66 modcall: group authorize returns updated for request 66 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 66 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 66 modcall: group authenticate returns handled for request 66 Sending Access-Challenge of id 68 to 10.0.0.1:21645 EAP-Message = 0x010600061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x029cb84784a586178ecaa439ab2c98ab Finished request 66 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 63 ID 65 with timestamp 435f8f1b Cleaning up request 64 ID 66 with timestamp 435f8f1b Cleaning up request 65 ID 67 with timestamp 435f8f1b Cleaning up request 66 ID 68 with timestamp 435f8f1b Nothing to do. Sleeping until we see a request.

1 0

SV: Problems Installation Debian
by Torkel Mathisen 27 Oct '05

27 Oct '05

Hi I had the same problem trying to install freeradius on Solaris 9. However when I moved it to Solaris 10 it worked. Why I don't know. However; I you don't plan to use X99 tokens you could just compile it without it. ./configure --without-rlm_x99_token Or you could even just delete the directory. Regards, Torkel -----Opprinnelig melding----- Fra: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] På vegne av awaradius(a)myawa.com Sendt: 26. oktober 2005 17:44 Til: freeradius-users(a)lists.freeradius.org Emne: Problems Installation Debian Hello everydoy, I am installing the last version of freeradius, but I have a bit problem in the installation. I work with debian. First of all, I download the software from freeradius´ web: radiusnoc:/# wget ftp://ftp.freeradius.org/pub/freeradius-1.0.5.tar.gz The next step: radiusnoc:/#tar zxvf freeradius-1.0.5.tar.gz After, I change to the directory: radiusnoc:/#cd freeradius-1.0.5 Now, I must do this steps: ./configure make make install But, it is here where I have some problems: radiusnoc:/freeradius-1.0.5# ./configure creating ./config.status creating Makefile creating config.h config.h is unchanged radiusnoc:/freeradius-1.0.5# make x99_rlm.c:492: error: `user_info' undeclared (first use in this function) make[6]: *** [x99_rlm.o] Error 1 make[6]: Leaving directory `/freeradius-1.0.5/src/modules/rlm_x99_token' make[5]: *** [common] Error 2 make[5]: Leaving directory `/freeradius-1.0.5/src/modules' make[4]: *** [all] Error 2 make[4]: Leaving directory `/freeradius-1.0.5/src/modules' make[3]: *** [common] Error 2 make[3]: Leaving directory `/freeradius-1.0.5/src' make[2]: *** [all] Error 2 make[2]: Leaving directory `/freeradius-1.0.5/src' make[1]: *** [common] Error 2 make[1]: Leaving directory `/freeradius-1.0.5' make: *** [all] Error 2 radiusnoc:/freeradius-1.0.5# make install make[4]: Leaving directory `/freeradius-1.0.5/src/modules' Making install in main... make[4]: Entering directory `/freeradius-1.0.5/src/main' /freeradius-1.0.5/libtool --mode=install /freeradius-1.0.5/install-sh -c -m 755 radiusd /usr/local/sbin /freeradius-1.0.5/install-sh -c -m 755 radiusd /usr/local/sbin/radiusd install: radiusd does not exist make[4]: *** [install] Error 1 make[4]: Leaving directory `/freeradius-1.0.5/src/main' make[3]: *** [common] Error 2 make[3]: Leaving directory `/freeradius-1.0.5/src' make[2]: *** [install] Error 2 make[2]: Leaving directory `/freeradius-1.0.5/src' make[1]: *** [common] Error 2 make[1]: Leaving directory `/freeradius-1.0.5' make: *** [install] Error 2 somebody can help me? somebody knows these errors? Thanks!!! - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Freeradius doesn't find VNUML hosts and nets
by andre kip 27 Oct '05

27 Oct '05

Hi, How do I configure freeradius to recognize the nets and hosts created by VNUML ? I have been getting "radtest unknown host (net) address". I however receive "Accept-Accept" on Localhost. trüffel ___________________________________________________________ Gesendet von Yahoo! Mail - Jetzt mit 1GB Speicher kostenlos - Hier anmelden: http://mail.yahoo.de

4 3

Re: reject reply
by hannibal 27 Oct '05

27 Oct '05

well, i've set reply_delay to 0, and it did work. thank you, men. but there is another question. if reply_delay=1, it should send the message in 1 sec, but with tcpdump, i found that it didn't send the message after 1 sec. and i think max_request_time plays a role here. someone knows?

1 0

LDAP Authentication
by James Taylor 27 Oct '05

27 Oct '05

I am currently trying to get LDAP authentication to work properly. As I am still learning the ins-and-outs on how all this comes together I am having an issue validating a user with Radius-LDAP. Attached is an example of the debug. Maybe it is just something stupid that I am doing. Thank you for your help! James Taylor EAP-Message = 0x573bea1ceb16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf666044c26dce30b13ecbacd04693e18 rad_recv: Access-Request packet from host 192.168.43.106:1645, id=126, length=151 User-Name = "jtaylor" Framed-MTU = 1400 Called-Station-Id = "0014.6ae0.3180" Calling-Station-Id = "0040.96a6.d46c" Service-Type = Login-User Message-Authenticator = 0x421ab8418995a7c7b6b94367b0d154d9 EAP-Message = 0x0204001119800000000715030100020230 NAS-Port-Type = Wireless-802.11 NAS-Port = 4082 State = 0xf666044c26dce30b13ecbacd04693e18 NAS-IP-Address = 192.168.43.106 NAS-Identifier = "SAP" rlm_ldap: - authorize rlm_ldap: performing user authorization for jtaylor rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user jtaylor authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 rlm_eap_tls: Length Included TLS Alert read:fatal:unknown CA TLS_accept:failed in SSLv3 read client certificate A 9963:error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca:s3_pkt.c:1052:SSL alert number 48 9963:error:140940E5:SSL routines:SSL3_READ_BYTES:ssl handshake failure:s3_pkt.c:837: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. rlm_eap_tls: BIO_read failed in a system call (-1), TLS session fails.

3 4

cheking mysql requests
by Alex M 27 Oct '05

27 Oct '05

Hi Im having problem with that freeradius doesn't recognize the clients (NAS) in the NAS table of MySQL.. It keeps throwing me: Unknown client nothing to do. So, I have set up sql.conf to trace mysql qureys in -X debug mode to YES, but I still don't see any qureys shown to the NAS table to see is the client is authorized. So how can I check if freeradius sends the query to the NAS table of the DB to SELECT * NAS where NASNAME = 'xxx.xxx.xxx.xxx' and SECRET='testing123' ??? I MUST make this work!!! Please help!

2 5

thread pool
by alexander＠infomed.sld.cu 27 Oct '05

27 Oct '05

At an ISP where we use freeradius with mysql in older to authenticate remote dial up users. The system worked fine until some weeks ago when there was an increase of the number of users and the radius begun to have troubles. For instance some days ago we have an electric problem and was nessesary shutdown the radius servers and the NASes. When turne on the system the radius daemon die with a "segmentation foult" error or it stay running but do not solve any request because an error of type: "There are no DB handles to use!" take care. Running radiusd -xx, the server die because with the error message: "can not spread more mysql connection" or something like this. Even frequently, at times of more trafic the server also die. I`m supose that it`s a problem of trafic due to the increase of the numbers of users. So i´m need to know if there any form of do that the radiusd accept just a limited number of requests in order to avoid that troubles when increase the load of the server? Regards. ------------------------------------------------- Este mensaje fue enviado usando el servicio de correo en web de Infomed http://webmail.sld.cu

2 1