- Freeradius-Users - lists.freeradius.org

EAP-PEAP GTC vs MSCHAPv2
by Don 27 Sep '13

27 Sep '13

All, I have successfully configured freeRadius using EAP-PEAP with: 1. GTC to authenticate user against local password 2. MSCHAPv2 to authenticate user against Active Directory via ntlm_auth following instructions on this link: http://wiki.freeradius.org/guide/FreeRADIUS-Active-Directory-Integration-HO… I also understand from reading this link that EAP-GTC can be used (compatible) with ntlm_auth: http://deployingradius.com/documents/protocols/compatibility.html That said, if EAP-GTC can be used along with ntlm_auth how do I configure it to make that work? I tried to execute ntlm_auth passing --password=%{User-Password}, but that didn't work as User-Password is empty. It says in eap.conf that GTC challenges the user with text and the response from the user is taken to be the User-Password. Perhaps I am executing ntlm_auth too early before GTC Password challenge is sent out and received the response. My questions are: 1. How can I configure freeRadius so GTC will work with ntlm_auth? 2. Is it possible to send subsequent GTC challenge in addition to default Password challenge? If possible, how do I configure the subsequent GTC challenge? Thank you.

2 6

Freeradius - DeadLock
by Alisson 25 Sep '13

25 Sep '13

Hi, I have a lot of logs with deadlocks.... ed Sep 25 15:05:44 2013 : Error: [sql] Couldn't update SQL accounting ALIVE record - Deadlock found when trying to get lock; try restarting transaction Wed Sep 25 15:05:44 2013 : Error: [sql] Couldn't update SQL accounting ALIVE record - Deadlock found when trying to get lock; try restarting transaction Wed Sep 25 15:05:44 2013 : Error: [sql] Couldn't update SQL accounting ALIVE record - Deadlock found when trying to get lock; try restarting transaction Wed Sep 25 15:05:44 2013 : Error: [sql] Couldn't update SQL accounting ALIVE record - Deadlock found when trying to get lock; try restarting transaction Wed Sep 25 15:05:44 2013 : Error: rlm_sql_mysql: Cannot store result Wed Sep 25 15:05:44 2013 : Error: rlm_sql_mysql: Cannot store result Wed Sep 25 15:05:44 2013 : Error: rlm_sql_mysql: MySQL error 'Deadlock found when trying to get lock; try restarting transaction' Wed Sep 25 15:05:44 2013 : Error: rlm_sql_mysql: MySQL error 'Deadlock found when trying to get lock; try restarting transaction' Wed Sep 25 15:05:44 2013 : Error: rlm_sql_mysql: Cannot store result Wed Sep 25 15:05:44 2013 : Error: [sql] Couldn't update SQL accounting ALIVE record - Deadlock found when trying to get lock; try restarting transaction Wed Sep 25 15:05:44 2013 : Error: [sql] Couldn't update SQL accounting ALIVE record - Deadlock found when trying to get lock; try restarting transaction Wed Sep 25 15:05:44 2013 : Error: rlm_sql_mysql: MySQL error 'Deadlock found when trying to get lock; try restarting transaction' Wed Sep 25 15:05:44 2013 : Error: rlm_sql_mysql: Cannot store result Wed Sep 25 15:05:44 2013 : Error: rlm_sql_mysql: MySQL error 'Deadlock found when trying to get lock; try restarting transaction' Wed Sep 25 15:05:44 2013 : Error: rlm_sql_mysql: Cannot store result Wed Sep 25 15:05:44 2013 : Error: rlm_sql_mysql: Cannot store result Wed Sep 25 15:05:44 2013 : Error: rlm_sql_mysql: MySQL error 'Deadlock found when trying to get lock; try restarting transaction' Wed Sep 25 15:05:44 2013 : Error: [sql] Couldn't update SQL accounting ALIVE record - Deadlock found when trying to get lock; try restarting transaction Wed Sep 25 15:05:44 2013 : Error: rlm_sql_mysql: Cannot store result Wed Sep 25 15:05:44 2013 : Error: rlm_sql_mysql: MySQL error 'Deadlock found when trying to get lock; try restarting transaction' Wed Sep 25 15:05:44 2013 : Error: [sql] Couldn't update SQL accounting ALIVE record - Deadlock found when trying to get lock; try restarting transaction Wed Sep 25 15:05:44 2013 : Error: rlm_sql_mysql: Cannot store result Wed Sep 25 15:05:44 2013 : Error: rlm_sql_mysql: MySQL error 'Deadlock found when trying to get lock; try restarting transaction' Wed Sep 25 15:05:44 2013 : Error: rlm_sql_mysql: MySQL error 'Deadlock found when trying to get lock; try restarting transaction'

3 5

Re: empty preacct and accounting section
by Alan Buxey 25 Sep '13

25 Sep '13

As the msg says. Your preacct {} and accounting {} sections in your server are not configured to do anything. Add active modules to them eg a database call and things will be different. alan

3 2

empty preacct and accounting section
by WorkingMan 25 Sep '13

25 Sep '13

I have been seen this weird message for two days now. I setup PPTP and IPSec (ikev1) with freeradius + mysql. In both cases I see Access-Acccept and in Accounting-Request I see these two message: WARNING: Empty preacct section. Using default return values. WARNING: Empty accounting section. Using default return values. I have no clue where it's wrong. PPTP can connect but IPSec connection would just keep sending Accounting-Request and never connects (it looks like connection depends on this step). The obvious consequence of this is that there is no accounting info in the DB (due to above warning). I did have success when configuring both separately before. When I combine both together it seems to always cause issue. I am sure it's a configuration issue but I just can't see where the problem is. I saw a post related to this before but it had no resolution other than telling OP that his configuration was wrong. One hint I have is the following log but I don't know what's the cause of it. ignoring request with ID <id>, already processing retransmitting RADIUS message ... #goes on for a while for IPSec, only twice for PPTP RADIUS is not responding Thanks

3 3

Help with sqlcounter for data transferred
by Fabrizio Fiore Donati 25 Sep '13

25 Sep '13

Hi, i'm configuring a server with a sql counter to check the total byte in a week for the users. But the server will reply a wrong count. Here's the counter: sqlcounter weeklybytecounter { counter-name = Weekly-Total-Max-Octets check-name = Max-Weekly-Octets reply-name = Mikrotik-Total-Limit sqlmod-inst = sql key = User-Name reset = weekly query = "SELECT (SUM(acctinputoctets)+SUM(acctoutputoctets)) FROM radacct WHERE UserName='%{%k}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%b'" But the reply doesn't is the operation between (check-name value) - (query value) for example: rlm_sqlcounter: Authorized user fabrizio, check_item=3000000000, counter=38101894 I expect a reply of 3000000000 - 38101894 = 2961898106 but i receive different value also bigger..... Any idea ? -- Fabrizio Fiore Donati Mobile: +39 3289872420 E-mail: fabrizio.fioredonati(a)2bite.net 2bite s.r.l. Via Saragat snc 67100 L'Aquila (AQ) - Italy Tel.: +39 0862441583

1 0

Re: Active Directory authentication question
by Alan Buxey 25 Sep '13

25 Sep '13

Well. There's no such thing as EAP-TLS/MSCHAPv2 . So I'd guess that your Android device is just doing PEAPv0/EAP-MSCHAPv2 or such and your config allows it to. If you ran in full debug mode when connecting with the Android device you'd see exactly what's happening alan

1 0

EAP-AKA, EAP-AKA'
by Arran Cudbard-Bell 25 Sep '13

25 Sep '13

Just out of interest is anyone using EAP-AKA with the EAP2 module in FreeRADIUS 2.x.x? If so what sorts of services are you using for? Have any telcos successfully deployed EAP-SIM/EAP-AKA['] for authenticating handsets to GSM and 802.11 networks to facilitate cross medium roaming? -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team

1 0

Proxy auth should supersede local auth
by JB 25 Sep '13

25 Sep '13

Hi! Our setup utilizes custom SQL schemas and functions for authentication and authorization. We now want to add a roaming proxy for a certain realm. When a user logs in using this realm, our custom SQL authorization should be skipped because our functions and the roaming proxy are completely different use cases. Our site now looks something like this: authorize { preprocess suffix if (Realm == "NULL") { custom-sql files } } At first glance, this seems to work but I wanted to know if there's a better or more common way to achieve this. Or is this completely stupid after all? (Why?) Thanks! JB

2 2

pap always returns noop for windows dialup authentication
by paul trader 24 Sep '13

24 Sep '13

hi all - i've recently tried upgrading from v1 to v2. on a centos 6.4 box w/ all latest updates, i installed freeradius v2, added one username and password to /etc/raddb/users: test Cleartext-Password := "testing" and the radtest command-line authentication works. i then added one client for our blade server to /etc/raddb/clients.conf: client x.x.x.x { secret = xxxxx shortname = 3coms } substituting the correct ip and secret for the x's. testing from my linux box w/ a modem, authentication works. output from radiusd -X shows all is well, my linux box receives an ip address and dns servers. relavant -X debug output shows: ++[pap] returns updated Found Auth-Type = PAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "testing" [pap] Using clear text password "testing" [pap] User authenticated successfully ++[pap] returns ok however, when trying to authenticate from a windows box, authentication fails. every time. i've tried it from a windows xp machine and 2 windows 7 machines. the debug output always says: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject i've been over and over everything a dozen times, have tried changing the windows dialup security settings to use pap only, and also have tried adding the following line to the users file: Auth-Type = PAP even though everything i've read said not to do that. still doesn't work. the only changes i've made to the default installation are to the users and clients.conf files. i have spent hours searching the internet for a similar problem/solution and come up empty. windows boxes will not authenticate, pap always returns noop, and the user is rejected. am i doing something glaringly wrong, or just going plain crazy? regards, paul

4 12

Re: Active Directory authentication question
by Alan Buxey 24 Sep '13

24 Sep '13

Or ask your distribution provider why they still provide wpa_supplicant package without eapol_test tool ;) alan

1 0