- Freeradius-Users - lists.freeradius.org

Error receiving packet: Bad address (version 2.2.5 then 2.2.9)
by Bertalan Voros 02 Nov '15

02 Nov '15

Hello All, I have been getting the following symptoms on one of the three FreeRADIUS servers I look after. The one affected is on a network that is not managed by me, so there is a possibility that something has chagned around it that I was not told of. The server otherwise has been running without issues for years more or less, it was 2.25 until today, when out of desperation I upgraded it to 2.2.9 but still getting the same behavior like before. Symptoms. 1. The server appears to be not responding. 2. When running in debug mode, it starts up as normal. When there is a request received, the log/console runs away with either of the two below: *Error receiving packet: Bad address* *Waking up in 23.6 seconds.* *Ready to process requests.Ready to process requests.Ready to process requests.Ready to process requests.Ready to process requests.Ready to process requests.* It has a Windows NPS server downstream that it uses as its authentication source. The same configuration has been working flawlessly at the other two sites, so something might have changed on the affected one, I am just unable to figure out what. Have you ever encountered these symptoms? Any guidance will be appreciated. Bertalan

2 1

Authenticated device does not receive and IP, so continuously requests IP allocation
by Sophie Loewenthal 02 Nov '15

02 Nov '15

Hi, For a few weeks some devices have had their IP allocation "lost" en route. They authenticate, and IP is allocated but not received by the device. Afterwards a device continuously asking for an IP address, being allocated, and then asking again. This has happened intermittently with some devices on Vodafone APN. I did not see devices on other APNs affected. Please see the three Radius requests in debug mode at the end of this email in attachments. They are small files of approx 10Kb and were collected with options to radiusd -xxx /etc/raddb/users ( with comments and empty lines stripped but willing to resend if empty lines and # comments are needed ) # grep -v ^# users | grep -v ^$ DEFAULT NAS-IP-Address == 172.200.100.1, Pool-Name := vodafone DEFAULT NAS-IP-Address == 10.19.255.254, Pool-Name := proximus-carli DEFAULT NAS-IP-Address == 10.17.255.254, Pool-Name := proximus-mechelen DEFAULT Framed-IP-Netmask = 255.255.255.255 O/S and packages Centos 6.2 freeradius-mysql-2.1.12-1.el6.x86_64 freeradius-utils-2.1.12-1.el6.x86_64 freeradius-2.1.12-1.el6.x86_64 Example from logs: Thu Oct 29 00:00:15 2015 : Auth: Login OK: [000006156] (from client vodafone-nas port 594301 cli 31655418538) Thu Oct 29 00:00:15 2015 : Info: Allocated IP: 10.26.0.61 from vodafone (did vodafone.exampleapn.com cli 31655418538 port 594301 user 000006156) Thu Oct 29 00:01:12 2015 : Auth: Login OK: [000006156] (from client vodafone-nas port 146587 cli 31655418538) Thu Oct 29 00:01:12 2015 : Info: Allocated IP: 10.26.0.61 from vodafone (did vodafone.exampleapn.com cli 31655418538 port 146587 user 000006156) Thu Oct 29 00:02:39 2015 : Auth: Login OK: [000006156] (from client vodafone-nas port 983132 cli 31655418538) Thu Oct 29 00:02:39 2015 : Info: Allocated IP: 10.26.0.61 from vodafone (did vodafone.exampleapn.com cli 31655418538 port 983132 user 000006156) Thu Oct 29 00:05:01 2015 : Auth: Login OK: [000006156] (from client vodafone-nas port 928184 cli 31655418538) Thu Oct 29 00:05:01 2015 : Info: Allocated IP: 10.26.0.61 from vodafone (did vodafone.exampleapn.com cli 31655418538 port 928184 user 000006156) Thu Oct 29 00:07:33 2015 : Auth: Login OK: [000006156] (from client vodafone-nas port 575003 cli 31655418538) Thu Oct 29 00:07:33 2015 : Info: Allocated IP: 10.26.0.61 from vodafone (did vodafone.exampleapn.com cli 31655418538 port 575003 user 000006156) Thu Oct 29 00:08:27 2015 : Auth: Login OK: [000006156] (from client vodafone-nas port 728168 cli 31655418538) Thu Oct 29 00:08:27 2015 : Info: Allocated IP: 10.26.0.61 from vodafone (did vodafone.exampleapn.com cli 31655418538 port 728168 user 000006156) This happens continuously amounting to 1000s of IP allocations daily. I do not see Info: Released IP entries for this device. ( there were some earlier this month. ) I have tcpdump running with : tcpdump -s0 -ni eth0 port 1812 or port 1813 or port 3799 -vw /tmp/rad.pcap Some questions, - Could my ippool run out of addresses because the device is continuously requesting IP addresses? - Would you offer any improvements on the tcpdump parameters? - How could I check if Radius really sent the packet back to the client? - (wireshark/tcpdump question: Is there an expression I could use to find the radius packet sent back for Info: Allocated IP? e.g I could radius.User_Name == "00000123" in wireshark to find User-Name we used for authentication. Is there any useful info in the attached debugs indicating problems? Like why the device did not receive an IP. If not then I can start looking into networks/vpn and vodafone. Kind regards.

3 5

Add custom ldap attribute to replies
by Angel L. Mateo 02 Nov '15

02 Nov '15

Hello, I have my freeradius connected to an LDAP server. I want now to add the CN attribute of my ldap users' entries to the freeradius reply. So I have: - Created a custom attribute (I haven't found any better, is there any?). This is the definition in the dictionary: ATTRIBUTE X-Atica-CN 3002 string - I have mapped the ldap's cn attribute to this attribute. In my ldap module configuration I have: update { ... reply:X-Atica-CN := 'cn' } - I have changed my authorized file: DEFAULT Auth-Type = LDAP, Realm != DEFAULT User-Name = "%{User-Name}", X-Atica-CN = "%{reply:X-Atica-CN}", Fall-Through = No but when I try with radtest, this custom attribute is not in the reply. In the freeradius debug file I can see that the ldap attribute is read while parsing the authorize file: 0) [ldap] = updated (0) files_aplicaciones: users: Matched entry DEFAULT at line 3 (0) files_aplicaciones: EXPAND %{User-Name} (0) files_aplicaciones: --> <my login> (0) files_aplicaciones: EXPAND %{reply:X-Atica-CN} (0) files_aplicaciones: --> <my cn in the ldap> but the attribute is not returned to radtest. I have also tried to force the inclusion in the post-auth section, with: post-auth { update reply { reply:X-Atica-CN = &reply:X-Atica-CN } ... } and with this, the debug file shows: (0) update reply { (0) reply:X-Atica-CN = &reply:X-Atica-CN -> <my cn in the ldap> (0) } # update reply = noop but it is not shown in the radtest reply. Any help? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868887590 Fax: 868888337

3 3

Run a php script after user successfully logged in
by Arash Shams 01 Nov '15

01 Nov '15

Hello i want to pass two argument ( user and companyid ) after successfully login for each one . i know i have to add a statement to post Auth in site-enabled/default but i dont know how any one can help me please thank you

2 1

The users session was previously rejected
by Pretlove, Tim 01 Nov '15

01 Nov '15

Hi, I fairly new at Freeradius and I have been upgrading our version 2 servers to version 3.0.10 and I have what I believe is a configuration issue. The user is correctly rejected by eap/MSCHAP but it continues into eap/PEAP where I get the error Sat Oct 31 09:08:24 2015 : Info: (11) eap_peap: The users session was previously rejected: returning reject (again.) Sat Oct 31 09:08:24 2015 : Info: (11) eap_peap: This means you need to read the PREVIOUS messages in the debug output Sat Oct 31 09:08:24 2015 : Info: (11) eap_peap: to find out the reason why the user was rejected Sat Oct 31 09:08:24 2015 : Info: (11) eap_peap: Look for "reject" or "fail". Those earlier messages will tell you Sat Oct 31 09:08:24 2015 : Info: (11) eap_peap: what went wrong, and how to fix the problem How do I avoid dropping into the peap section if the user is rejected further up the chain? I've attached the portion of the debug log that shows this error. Many thanks Tim

5 7

Huntgroup-Name vs client:group
by Óscar Remírez de Ganuza Satrústegui 30 Oct '15

30 Oct '15

Good afternoon, We are migrating previous radius (2.1.9) authentication to a new instance of freeradius (3.0.10). We are moving two different configurations to a single radius. As we are supporting AAA from diferent services, we are using Huntgroup-Name attribute to separate the authorization. if ( Huntgroup-Name == 'Wireless' ) { if ( Ldap-Group == "unav.wireless.1" ) { update reply { ... } } ... } elsif ( Huntgroup-Name == 'Wired' ) { if ( Ldap-Group == "unav.wired.1" ) { ... } .... } We are doing it even on the inner-tunnel; using copy_request_to_tunnel, and with module preprocess on the inner-tunnel. It is working ok. But I have just found a previous suggestion on this list [1] in which it is suggested to check "client:group" instead of huntgroup-name: *"do policy checking via %{client:group} instead of Huntgroup-Name. It will do the same thing, and will be *enormously* faster."* In our particular setting, we have around 7 huntgroups for a total of 20 NAS-Clients. And we receive 20 different Access Requests per second on top moments. In our case, do you think that we are also going to experience a much better performance using client:group instead of huntgroup-name? I had been looking for information on client:group, but I could not find a lot of it. [2] Thank you very much for your help. Regards, [1] http://lists.freeradius.org/pipermail/freeradius-users/2014-February/070431… [2] https://github.com/FreeRADIUS/freeradius-server/blob/master/raddb/clients.c… *Oscar Remírez de Ganuza Satrústegui* IT Services Universidad de Navarra Tel. +34 948425600 x803130 http://www.unav.edu/web/it/

2 1

question regarding PEAP/MSCHAPv2 (ERROR: FAILED: No NT/LM-Password. Cannot perform authentication)
by Thomas Stather 30 Oct '15

30 Oct '15

Hello I am still failing with my RADIUS setup (eduroam -> PEAP/MSCHAPv2 and authentication against our LDAP server) on 3.0.10 After having sorted out lots of mistakes by myself in the RADIUS config (thanks for you help on the previous post), the server now starts. But when i try to connect with my mobile device to the test SSID, i get: ---------------------------------------------------------------------- ... (6) ldap1: User object found at DN "uid=tstather,ou=people,dc=mpimf-heidelberg,dc=mpg,dc=de" rlm_ldap (ldap1): Released connection (0) (6) [ldap1] = ok (6) } # redundant redundant_ldap = ok (6) [pap] = noop (6) } # authorize = updated (6) Found Auth-Type = EAP (6) # Executing group from file /etc/raddb/sites-enabled/mpimf_inner-tunnel (6) authenticate { (6) eap: Expiring EAP session with state 0x8d973f168d3225fd (6) eap: Finished EAP session with state 0x8d973f168d3225fd (6) eap: Previous EAP request found for state 0x8d973f168d3225fd, released from the list (6) eap: Peer sent packet with method EAP MSCHAPv2 (26) (6) eap: Calling submodule eap_mschapv2 to process data (6) eap_mschapv2: # Executing group from file /etc/raddb/sites-enabled/mpimf_inner-tunnel (6) eap_mschapv2: Auth-Type MS-CHAP { (6) mschap: WARNING: No Cleartext-Password configured. Cannot create NT-Password (6) mschap: WARNING: No Cleartext-Password configured. Cannot create LM-Password (6) mschap: Creating challenge hash with username: tstather(a)mpimf-heidelberg.mpg.de (6) mschap: Client is using MS-CHAPv2 (6) mschap: ERROR: FAILED: No NT/LM-Password. Cannot perform authentication (6) mschap: ERROR: MS-CHAP2-Response is incorrect (6) [mschap] = reject (6) } # Auth-Type MS-CHAP = reject (6) eap: Sending EAP Failure (code 4) ID 165 length 4 (6) eap: Freeing handler (6) [eap] = reject (6) } # authenticate = reject (6) Failed to authenticate the user (6) Using Post-Auth-Type Reject (6) # Executing group from file /etc/raddb/sites-enabled/mpimf_inner-tunnel (6) Post-Auth-Type REJECT { (6) attr_filter.access_reject: EXPAND %{User-Name} (6) attr_filter.access_reject: --> tstather(a)mpimf-heidelberg.mpg.de (6) attr_filter.access_reject: Matched entry DEFAULT at line 11 (6) [attr_filter.access_reject] = updated (6) } # Post-Auth-Type REJECT = updated (6) } # server mpimf_inner-tunnel (6) Virtual server sending reply (6) MS-CHAP-Error = "\245E=691 R=1 C=d3892ab1fa88824c1ae8daf07fc80483 V=3 M=Authentication failed" (6) EAP-Message = 0x04a50004 (6) Message-Authenticator = 0x00000000000000000000000000000000 ... ---------------------------------------------------------------------- Our LDAP server has the attributes "sambaLMPassword" and "sambaNTPassword" (there is also a samba server linked to it). I read some documentation but now im confused. Am i right in the assumption that the error occurs because our LDAP server has no "clear-text password" entries for the users? Is the only option to get it to work use the "ntlm_auth" module? I wanted to implement this setup independently of our samba server, or is this simply not possible? Best, Thomas -- Thomas Stather IT Services Tel: +49 6221-486 628 Fax: +49 6221-486 561 ------------------------------------------------------------------------ Max Planck Institute for Medical Research (MPImF) Jahnstrasse 29, 69120 Heidelberg Germany

5 7

Problem with config (if- statement) on 3.0.10
by Thomas Stather 30 Oct '15

30 Oct '15

Hello Now i have my up to date radius installation but i am struggeling with my configuration (i need to implement an eduroam config using PEAP-MSCHAPv2 and EAP-TTLS-MSCHAPv2 in combination with our LDAP servers). The server won't start, attached is the output: ----------------------------------- radius1:/etc/raddb # radiusd -X Copyright (C) 1999-2015 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/detail including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/echo including configuration file /etc/raddb/mods-enabled/chap including configuration file /etc/raddb/mods-enabled/expiration including configuration file /etc/raddb/mods-enabled/files including configuration file /etc/raddb/mods-enabled/digest including configuration file /etc/raddb/mods-enabled/sradutmp including configuration file /etc/raddb/mods-enabled/cache_eap including configuration file /etc/raddb/mods-enabled/unix including configuration file /etc/raddb/mods-enabled/replicate including configuration file /etc/raddb/mods-enabled/dynamic_clients including configuration file /etc/raddb/mods-enabled/passwd including configuration file /etc/raddb/mods-enabled/ldap including configuration file /etc/raddb/mods-enabled/detail.log including configuration file /etc/raddb/mods-enabled/inner-eap including configuration file /etc/raddb/mods-enabled/mschap including configuration file /etc/raddb/mods-enabled/exec including configuration file /etc/raddb/mods-enabled/expr including configuration file /etc/raddb/mods-enabled/utf8 including configuration file /etc/raddb/mods-enabled/eap including configuration file /etc/raddb/mods-enabled/unpack including configuration file /etc/raddb/mods-enabled/realm including configuration file /etc/raddb/mods-enabled/soh including configuration file /etc/raddb/mods-enabled/attr_filter including configuration file /etc/raddb/mods-enabled/dhcp including configuration file /etc/raddb/mods-enabled/logintime including configuration file /etc/raddb/mods-enabled/ntlm_auth including configuration file /etc/raddb/mods-enabled/radutmp including configuration file /etc/raddb/mods-enabled/preprocess including configuration file /etc/raddb/mods-enabled/linelog including configuration file /etc/raddb/mods-enabled/pap including files in directory /etc/raddb/policy.d/ including configuration file /etc/raddb/policy.d/canonicalization including configuration file /etc/raddb/policy.d/debug including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/operator-name including configuration file /etc/raddb/policy.d/abfab-tr including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/dhcp including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/eduroam /etc/raddb/sites-enabled/mpimf_eduroam[65]: Invalid location for 'if' Errors reading or parsing /etc/raddb/radiusd.conf ----------------------------------- the /sites-enabled/eduroam looks like this: ----------------------------------- authorize { preprocess auth_log mschap suffix eap { ok = return } files redundant_ldap } authenticate { Auth-Type MS-CHAP { mschap } Auth-Type eap { eap update control { Tmp-String-0 = "%{debug:2}" } update control { Tmp-String-0 = "%{debug:0}" } } } preacct { preprocess acct_unique suffix } accounting { detail unix radutmp exec attr_filter.accounting_response } session { radutmp } post-auth { reply_log redundant_ldap exec Post-Auth-Type REJECT { attr_filter.access_reject } ### enable debug logging from here on update control { Tmp-String-0 = "%{debug:2}" } if (Realm == my-realm.de || Realm == NULL) { update reply { Filter-Id = "my-realm-Secure.in" } } else { update reply { Filter-Id = "gast.in" } } ### disable debug logging again update control { Tmp-String-0 = "%{debug:0}" } } pre-proxy { pre_proxy_log } post-proxy { post_proxy_log eap } ----------------------------------- What am i doing wrong? Best, Thomas -- Thomas Stather IT Services Tel: +49 6221-486 628 Fax: +49 6221-486 561 ------------------------------------------------------------------------ Max Planck Institute for Medical Research (MPImF) Jahnstrasse 29, 69120 Heidelberg Germany

2 4

My Freeradius server throws errors ,please guide
by Yusuf Siddiqui 29 Oct '15

29 Oct '15

Hi I have tried to change the mod of the file to +r mode still i see this error,what could be reason behind it,please guide. ÃÃÃÃÃÃÃÃÃÃÃÃÃÃÃÅÃÃÅ¸" Thu Oct 29 20:56:03 2015 : Debug: } Thu Oct 29 20:56:03 2015 : Debug: instantiate { Thu Oct 29 20:56:03 2015 : Debug: } Thu Oct 29 20:56:03 2015 : Debug: modules { Thu Oct 29 20:56:03 2015 : Debug: # Instantiating module "etc_passwd" from file /usr/local/etc/raddb/mods-enabled/passwd Thu Oct 29 20:56:03 2015 : Debug: rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no Thu Oct 29 20:56:03 2015 : Debug: # Instantiating module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess Thu Oct 29 20:56:03 2015 : Debug: reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/huntgroups Thu Oct 29 20:56:03 2015 : Debug: reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/hints Thu Oct 29 20:56:03 2015 : Debug: # Instantiating module "detail" from file /usr/local/etc/raddb/mods-enabled/detail Thu Oct 29 20:56:03 2015 : Debug: # Instantiating module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log Thu Oct 29 20:56:03 2015 : Debug: rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output Thu Oct 29 20:56:03 2015 : Debug: # Instantiating module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log Thu Oct 29 20:56:03 2015 : Debug: # Instantiating module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log Thu Oct 29 20:56:03 2015 : Debug: # Instantiating module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log Thu Oct 29 20:56:03 2015 : Debug: # Instantiating module "attr_filter.post-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter Thu Oct 29 20:56:03 2015 : Debug: reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/post-proxy Thu Oct 29 20:56:03 2015 : Error: Couldn't open /usr/local/etc/raddb/mods-config/attr_filter/post-proxy for reading: Permission denied Thu Oct 29 20:56:03 2015 : Error: Errors reading /usr/local/etc/raddb/mods-config/attr_filter/post-proxy Thu Oct 29 20:56:03 2015 : Error: /usr/local/etc/raddb/mods-enabled/attr_filter[12]: Instantiation failed for module "attr_filter.post-proxy" Regards Yusuf Siddiqui *__________________________________________________________________________________________________________________________________________________________________* This communication & accompanying documents ("this e-mail") contains confidential and/or privileged information for exclusive use of the individual to whom it is addressed. If you are not the intended recipient, please immediately notify the company & delete this e-mail. Any unauthorized use or disclosure of this e-mail is strictly prohibited. Representations in this e-mail are subject to contract. As an e-mail user please be cautious of the technical & other vulnerabilities of the internet which may result in malicious and/or unauthorized access to / use / alteration of e-mails/e-mail IDs. Thank you. *_______________________________________________________________________________________________________________________________________________________________*

2 1

Understanding debugging logs
by David Hartburn 29 Oct '15

29 Oct '15

Hi, Is there any advised technique or tools out there to help understanding FreeRADIUS debugging output generated by radmin/raddebug? A lot of information is generated, but a method of cutting out repeated information or quickly highlighting issues in a debug session would be handy. If not, is the best method working backwards, checking for errors in each packet log? I am already filtering by MAC or User-Name to make sure I just have output from the session I want. This is not a complaint. We are currently moving from NPS so having useful debugging is brilliant and a whole new world where problems seem solvable! I'm always interested in anything that will make life easier though :) Dave Hartburn

6 7