- Freeradius-Users - lists.freeradius.org

Bug #256 should go into 1.0.5
by Thor Spruyt 19 Aug '05

19 Aug '05

http://bugs.freeradius.org/show_bug.cgi?id=256 It's a really big mistake and only a 1-line change! -- Groeten, Regards, Salutations, Thor Spruyt M: +32 (0)475 67 22 65 E: thor.spruyt(a)telenet.be W: www.thor-spruyt.com www.salesguide.be www.telenethotspot.be

2 1

FR suddenly doesn't respond any more and eats all cpu
by Benedikt Panzer 19 Aug '05

19 Aug '05

Hello everyone, I've configured here a FreeRADIUS 1.0.4 and I'm running it now to handle test requests. First, everything looked ok. FR responded all requests correctly. But suddenly it didn't respond any more to RADIUS requests and I saw it used 1 of my 2 cpus completly. Before it took between 1-2 percent of the cpu. FreeRADIUS even could not be killed by a normal kill, I needed kill -9 to terminate it. It's very strange to me that happend after half an hour normal behavior. Then I started FreeRADIUS in debugging mode (-X) but then the error didn't occur until I stopped it 1 day later. Just now I ran it again in not-debugging mode and again after about half an hour the same strange error: processor load about 99% and no responses to any requests. And at the moment there are really few RADIUS requests. As I wrote, I don't have any debugging output before the error occured. The error doesn't occur when running in debugging mode. It doesn't want to be caught ;-) Nevertheless, has anyone yet seen such a behavior or has an idea where to look or a guest for the reason? Thanks a lot, Benedikt -- Benedikt Panzer Abteilung Ausbildung Rechenzentrum Universität Stuttgart Allmandring 30 70550 Stuttgart www.rus.uni-stuttgart.de

4 7

Release date for 1.1.0/CVS?
by Wesley Spadola 19 Aug '05

19 Aug '05

Is there any news of a approximate release date for the 1.1.0 line of FreeRADIUS? Which bugs are currently showstoppers for this line to be released as "stable"? Thanks, Wes

3 3

EAP OTP
by Juan Daniel Moreno 19 Aug '05

19 Aug '05

Hello everyone, I am interested in EAP protocols with OTP (one time password). I would like to configure my freeradius 1.0.4 to be able to authenticate passwords which has been created with Shawan's method and an external key. Can anybody help me? Thank you, Juan Daniel MORENO

2 1

FR with MySQL. Proxying and repeated entries
by Paolo Rotela 19 Aug '05

19 Aug '05

Hi. Sorry if this is a dumb thing, but I've searched a lot and din't find any solution to this problem. I'm using freeradius (versions 0.9.3, 1.0.0 and 1.0.4) with MySQL 3.23 and 4.1.7 (different mappings between FR and My) I have some clients to wich I'm proxying requests to some realms. All works OK but there is one client wich is using Cisco Secure ACS, wich is giving me some headaches. With this one, Access-* packets go OK, but when the NAS (Cisco AS5300) sends an Accounting-Request to that realm and I proxy it to the home server, it sends me an Accounting-Response with an (I think) irregular attribute: Message-Authenticator (Ext. Attr. 80), wich I think is not permitted in the RFC for accounting packets. So, my FR, discards it as supposed thus leading my NAS to re-send accounting request a lot of times until it gives up. This leads me to three main questions: 1) Am I reading OK the RFC? I mean ¿Is it right that Attribute 80 is NOT permitted in Accounting-* packets? 2) Each time the NAS re-sends packets, FR handles it as it were a new packet, for a new call/connection. This way, I have each call for this specific realm n times, with n being the times I configure the NAS to re-send the packet. Every time the NAS re-sends an Accounting-start, the SQL query in sql.conf says "INSERT blah blah blah", wich leads to a new record be inserted into the database, and every time the NAS re-sends an Accounting-stop, the SQL query says "UPDATE blah blah blah", so it leads to calls being recorded many times. The question is ¿is there any way to solve this through configuration, and I didn't find it because I'm a dumb? ¿Or I have to "touch" the code for the radius to verify if the packet is a repeated one or not? 3) Is there any known bug or propietary feature from Cisco wich causes this incompatibility thing? I've searched about it and didn't find anything. I know that "3" is not at all about freeradius, but perhaps some of you came accross this at any time. Any help will be very appreciated.

2 1

Issues authenticating vs 2003 AD
by Tim P 19 Aug '05

19 Aug '05

I am handing off a qurest from pppd to radius and am failing with a valid user in the domain. Here is the output of radiusd -X -A Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32769, id=39, length=72 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "ppptest" CHAP-Password = 0xa3de2596eae8f89f46e35d612d8858ac55 NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "ppptest", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 155 users: Matched entry DEFAULT at line 173 users: Matched entry DEFAULT at line 185 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for ppptest radius_xlat: '(sAMAccountName=ppptest)' radius_xlat: 'dc=company,dc=org' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to domcon.company.org:389, authentication 0 rlm_ldap: bind as cn=administrator,cn=Users,dc=company,dc=org/password to domcon.company.org:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=company,dc=org, with filter (sAMAccountName=ppptest) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user ppptest authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type CHAP auth: type "CHAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_chap: login attempt by "ppptest" with CHAP password rlm_chap: Could not find clear text password for user ppptest modcall[authenticate]: module "chap" returns invalid for request 0 modcall: group Auth-Type returns invalid for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 39 to 127.0.0.1:32769 Waking up in 2 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 39 with timestamp 4303762d Nothing to do. Sleeping until we see a request. Any ideas? Both mschap and chap are enabled in the radiusd.conf

2 11

freeradius 1.0.4 and Cisco WLSE
by jck-freeradius＠southwestern.edu 19 Aug '05

19 Aug '05

I am trying to speak between my Freeradius server and a Cisco WLSE. I am seeing EAP timeouts while WLSE is trying to authenticate through Freeradius. I have setup the AAA details (server,port,username,password,eap protocol) in the WLSE, and enabled fault tracking, so that polling is able to take place. The WDS Master router has no problems authenticating, it is the WLSE that I am having problems getting authenticated. AP-70#show wlccp wnm status WNM IP Address : 192.168.254.5 Status : NOT AUTHENTICATED AP-70#show wlccp wds MAC: 0014.6a77.1604, IP-ADDR: 192.168.254.70 , Priority: 254 Interface BVI1, State: Administratively StandAlone - ACTIVE AP Count: 43 , MN Count: 9 == The WLSE is speaking with freeradius: (output from tcpdump) 17:40:36.415982 IP wlse.southwestern.edu.32815 > radius.southwestern.edu.radius: rad-access-req 132 [id 3] Attr[ User{wlseacct} NAS_ipaddr{wlse.southwestern.edu} Called_station{ABBAABBAABBA} [|radius] 17:40:36.422513 IP radius.southwestern.edu.radius > wlse.southwestern.edu.32815: rad-access-cha 92 [id 3] Attr[ [|radius] 17:40:36.423393 IP wlse.southwestern.edu.32815 > radius.southwestern.edu.radius: rad-access-req 125 [id 3] Attr[ User{wlseacct} NAS_ipaddr{wlse.southwestern.edu} Called_station{ABBAABBAABBA} [|radius] 17:40:42.433507 IP radius.southwestern.edu.radius > wlse.southwestern.edu.32815: rad-access-reject 20 [id 3] == == ...and the output from Freeradius rad_recv: Access-Request packet from host 192.168.254.10:32815, id=3, length=132 User-Name = "wlseacct" NAS-IP-Address = 192.168.254.10 Called-Station-Id = "ABBAABBAABBA" Calling-Station-Id = "ABBAABBAABBA" NAS-Identifier = "Cisco Secure II" NAS-Port = 29 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200000d01776c736561636374 Message-Authenticator = 0x586aa1b877caeafd3956095cf718be31 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 180 rlm_eap: EAP packet type response id 0 length 13 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 180 radius_xlat: 'wlseacct' rlm_sql (sql): sql_set_user escaped user --> 'wlseacct' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'wlseacct' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 0 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'wlseacct' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'wlseacct' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'wlseacct' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 0 modcall[authorize]: module "sql" returns ok for request 180 modcall: group authorize returns updated for request 180 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 180 rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 180 modcall: group authenticate returns handled for request 180 Sending Access-Challenge of id 3 to 192.168.254.10:32815 EAP-Message = 0x010100221a0101001d10b063da2c8f5c52273cd537b0c09d69e5776c736561636374 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8c90735921dd51b22bc8ef97379845b8 Finished request 180 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.254.10:32815, id=3, length=125 User-Name = "wlseacct" NAS-IP-Address = 192.168.254.10 Called-Station-Id = "ABBAABBAABBA" Calling-Station-Id = "ABBAABBAABBA" NAS-Identifier = "Cisco Secure II" NAS-Port = 29 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020300060311 Message-Authenticator = 0x070f8a208866000f797e64be5bd48f48 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 181 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 181 radius_xlat: 'wlseacct' rlm_sql (sql): sql_set_user escaped user --> 'wlseacct' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'wlseacct' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'wlseacct' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'wlseacct' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'wlseacct' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 181 modcall: group authorize returns updated for request 181 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 181 rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request rlm_eap: Failed in handler modcall[authenticate]: module "eap" returns invalid for request 181 modcall: group authenticate returns invalid for request 181 auth: Failed to validate the user. rad_lowerpair: User-Name now 'wlseacct' rad_rmspace_pair: User-Name now 'wlseacct' Processing the authorize section of radiusd.conf modcall: entering group authorize for request 181 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 181 radius_xlat: 'wlseacct' rlm_sql (sql): sql_set_user escaped user --> 'wlseacct' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'wlseacct' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'wlseacct' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'wlseacct' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'wlseacct' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns ok for request 181 modcall: group authorize returns updated for request 181 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 181 rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request rlm_eap: Failed in handler modcall[authenticate]: module "eap" returns invalid for request 181 modcall: group authenticate returns invalid for request 181 auth: Failed to validate the user. Delaying request 181 for 1 seconds Finished request 181 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Sending Access-Reject of id 3 to 192.168.254.10:32815 Cleaning up request 181 ID 3 with timestamp 42fa8264 Nothing to do. Sleeping until we see a request. == I have read in places that there are patches, that may fix my issue. Are these patches my solution, and where can I get the most recent version? --johnk

2 3

radius cache?
by Tariq Rashid 19 Aug '05

19 Aug '05

hi - i wonder what people's thoughts are on a radius cache that sits in frotn of a set of real radius servers and responds quickly with a set of cached reply attributes from a previous query? this may even be worthwhile even if the caching only applies to rejected queries - so that bad requests don't waste the backend resources. tariq

2 1

RE: mod_auth_radius values
by Ayres G.J. 19 Aug '05

19 Aug '05

Hi, I have written a php script that lists the request and response headers, the result of which is below: Request Headers Accept: */* Accept-Language: en-gb Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Host: xxxxxx Connection: Keep-Alive Authorization: Basic bHNreVJlZ2o6ZnSpZGF5Mw== Cookie: foo=bar Response Headers Set-Cookie: RADIUS=51f673efff8c5h235410d95289666de85305b928; path=/; X-Powered-By: PHP/4.4.0 After the cookie is set the 'Set-Cookie' header appears in the Request Header as 'Cookie: foo=bar; RADIUS=51f673efff8c5h235410d95289666de85305b928;'. (I have modified the values above slightly incase I am inadvertently sending a username/password to the list ;) Ive read through mod_auth_radius-2.0.c and it appears the cookie is a MD5 hash of the users information. So, is it possible to get the information from the cookie? Gareth. -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Alan DeKok Sent: 18 August 2005 16:25 To: FreeRadius users mailing list Subject: Re: mod_auth_radius values "Ayres G.J." <G.J.Ayres(a)swansea.ac.uk> wrote: > I am developing a web system that authenticates users to a web site > through free radius using the mod_auth_radius module for apache. It all > works fine, but I would like to get the username of the user that has > authenticated for use on pages once they have authenticated. It's in the HTTP headers. The username & password are sent in every request. > I am not sure how to go about this. I guess that the values are set in a > cookie or in the HTTP Headers by mod_auth_radius? Does anyone know a way I > could retrieve the values, either through HTML or PHP? Not HTML. Maybe PHP, if it allows you to get HTTP headers. See the module source code for where the headers are, and the PHP docs for how to get at them. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Required Clarification
by raghavendra.sadaramachandra＠wipro.com 19 Aug '05

19 Aug '05

Hi All, As I am using freeRADIUS I would like to know few of the following things. 1) What is the maximum length of username and password allowed in freeRADIUS ? 2) What is the maximum number of users allowed to authenticate? I mean, how many users does it maintains in its database? 3) How does it maintains database does it uses SQL, if so ? whether it provides any alternative to maintain database of username and password ? for example like by using files..... etc. 4) Is there any necessity or possibility to use secondary RADIUS server ? Thanx in advance. Regards, Raghu Confidentiality Notice The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain confidential or privileged information. If you are not the intended recipient, please notify the sender at Wipro or Mailadmin(a)wipro.com immediately and destroy all copies of this message and any attachments.

2 1