- Freeradius-Users - lists.freeradius.org

rlm_sql_mysql driver issue
by QASIM RAO 11 Feb '13

11 Feb '13

Hi,i am trying to configure rlm_sql_mysql driver but it is showing radisud is not working :( mysql devel is installed. [root@localhost rlm_sql_mysql]# ./configure checking for gcc... gccchecking for C compiler default output file name... a.outchecking whether the C compiler works... yeschecking whether we are cross compiling... nochecking for suffix of executables... checking for suffix of object files... ochecking whether we are using the GNU C compiler... yeschecking whether gcc accepts -g... yeschecking for gcc option to accept ANSI C... none neededchecking for mysql_config... yeschecking for pthread_create in -lpthread... yeschecking for mysql_init in -lmysqlclient_r (using mysql_config)... nochecking for mysql_init in -lmysqlclient_r... noconfigure: WARNING: mysql libraries not found. Use --with-mysql-lib-dir=<path>.checking for mysql.h (using mysql_config)... yesconfigure: WARNING: sql submodule 'mysql' disabledconfigure: creating ./config.statusconfig.status: creating Makefileconfig.status: creating config.h[root@localhost rlm_sql_mysql]# makemake: Nothing to be done for `all'. Please Help me in this Regards:Rao Qasim

3 2

Fwd: FW: Radius server is dumping regularly
by ramakrishna 11 Feb '13

11 Feb '13

** ** Hi **** I have been using FreeRadius 2.2 for a while now. Recently i have started seeing regular code dumps by RADIUS server. I have attached pstack output of three core files generated within last four days. I observed that core dump is happening consistently in rad_decode function and its sub functions. **** Please lemme know what might have gone wrong.**** Thanks,**** -- Best Regards, M.Rama Krishna Prasad,

2 3

Re: Degradation of service when authentication fails with Windows AD
by Antonio Alberola 11 Feb '13

11 Feb '13

> If you can describe the problem you're having, in correct terminology, > people might be able to make a suggestion. Be specific, about the > issues, the architecture you have, what you're trying to achieve, and so on. > Sorry, I will try to explain the problem better. I have a mail server where users are validated with local accounts (UNIX) or against a Windows AD. For this reason we use Radius. Sometimes the Radius server fails and stops authentication for everybody. In that point the logs that I sent to you appear. I need to restart Radius in order to it works again. > From what you've described so far, it sounds like you are losing > connectivity to one or more AD controllers, which is causing PAM > to hang (waiting for a Kerberos reply) or Samba/ntlm_auth to hang > (waiting for an RPC reply). > > It should be obvious what the solution is - reliable connectivity to a reliable AD controller. When we monitored the network and one of the Windows AD we could confirm that requests from Radius don't reach the AD, because they don't leave Radius. We believe that connectivity between Radius and AD is correct, they are on the same LAN and the AD continues to validate correctly even when Radius is failing. >From my point of view, for any reason, Radius receives requests that it can not manage, because of the AD, the network or whatever. These requests keep waiting and the buffer fills completly. I don't know why these requests are not removed from the queue and the buffer is cleared in order to allow new request. In this way we could avoid that request to the rest of the AD fail because of a particular AD.

3 2

Dualstack NAS ignored by RADIUS server when using IPv4
by Ondrej Famera 11 Feb '13

11 Feb '13

Hello all, I'm running freeRADIUS 2.2.0 server on dualstack machine. Some of the NAS devices that are using this server are dualstack, but they are not able to use IPv6 for communicating with RADIUS server so they use only the IPv4. Problem is that these NAS devices are rejected by RADIUS server with following error: Error: Ignoring request to authentication address 10.0.0.1 port 1812 from unknown client 10.0.0.2 port 1812 DNS: freeRADIUS server: radius.example.com - IPv4: 10.0.0.1 - IPv6: 2001:a:b:c::1 NAS device: dev1.example.com - IPv4: 10.0.0.2 - IPv6: 2001:a:b:c::2 RADIUS nas table: id | nasname | shortname | type | ports | secret | community | description | server ----+-------------------+-----------+-------+--------+---------------+-----------+-------------+-------------- 1 | dev1.example.com | dev1 | other | <NULL> | shared_secret | <NULL> | <NULL> | inner-tunnel By adding folloving to nas table it works: id | nasname | shortname | type | ports | secret | community | description | server ----+-------------------+-----------+-------+--------+---------------+-----------+-------------+-------------- 2 | 10.0.0.2 | dev1 | other | <NULL> | shared_secret | <NULL> | <NULL> | inner-tunnel ( it works as workaround but i think that it should work as well with hostname only ) Having IPv4-only or IPv6-only NAS doesn't trigger this problematic behaviour, as well as having dualstack NAS taht can communicate with RADIUS over IPv6. looks like bug to me, anyone experienced similiar problems? -- Ondrej Famera unix@fi

7 8

freeradius not working in normal mode but working in debug mode
by Nandkumar Palkar 11 Feb '13

11 Feb '13

Hi freeradius not working in normal mode but working in debug mode. Please suggest. Thanks, Nand

3 7

Libraries issue
by QASIM RAO 11 Feb '13

11 Feb '13

hi,i am facing problem during compilation of freeradius rlm_sql_mysql driver [root@localhost rlm_sql_mysql]# ./configure checking for gcc... gccchecking for C compiler default output file name... a.outchecking whether the C compiler works... yeschecking whether we are cross compiling... nochecking for suffix of executables... checking for suffix of object files... ochecking whether we are using the GNU C compiler... yeschecking whether gcc accepts -g... yeschecking for gcc option to accept ANSI C... none neededchecking for mysql_config... yeschecking for pthread_create in -lpthread... yeschecking for mysql_init in -lmysqlclient_r (using mysql_config)... yeschecking for mysql.h (using mysql_config)... yesconfigure: creating ./config.statusconfig.status: creating Makefileconfig.status: creating config.hconfig.status: config.h is unchanged[root@localhost rlm_sql_mysql]# make/usr/src/radius-iptv/libtool --mode=compile gcc -g -O2 -I../.. -I/usr/src/radius-iptv/src/include -I/usr/include/mysql -g -pipe -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -fPIC -g -static-libgcc -fno-omit-frame-pointer -fno-strict-aliasing -DMY_PTHREAD_FASTMUTEX=1 -c sql_mysql.cmkdir .libs gcc -g -O2 -I../.. -I/usr/src/radius-iptv/src/include -I/usr/include/mysql -g -pipe -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -fPIC -g -static-libgcc -fno-omit-frame-pointer -fno-strict-aliasing -DMY_PTHREAD_FASTMUTEX=1 -c sql_mysql.c -fPIC -DPIC -o .libs/sql_mysql.osql_mysql.c: In function 'sql_error':sql_mysql.c:335: warning: return discards qualifiers from pointer target type gcc -g -O2 -I../.. -I/usr/src/radius-iptv/src/include -I/usr/include/mysql -g -pipe -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -fPIC -g -static-libgcc -fno-omit-frame-pointer -fno-strict-aliasing -DMY_PTHREAD_FASTMUTEX=1 -c sql_mysql.c -o sql_mysql.o >/dev/null 2>&1/usr/src/radius-iptv/libtool --mode=link gcc -release 1.1.6 \ -module -export-dynamic -o rlm_sql_mysql.la \ -rpath /usr/local/lib sql_mysql.lo -L/usr/lib64 -lmysqlclient_r -lpthread -lm -lrt -ldl gcc -shared .libs/sql_mysql.o -L/usr/lib64 -lmysqlclient_r -lpthread -lm -lrt -ldl -Wl,-soname -Wl,rlm_sql_mysql-1.1.6.so -o .libs/rlm_sql_mysql-1.1.6.so(cd .libs && rm -f rlm_sql_mysql.so && ln -s rlm_sql_mysql-1.1.6.so rlm_sql_mysql.so)ar cru .libs/rlm_sql_mysql.a sql_mysql.oranlib .libs/rlm_sql_mysql.acreating rlm_sql_mysql.la(cd .libs && rm -f rlm_sql_mysql.la && ln -s ../rlm_sql_mysql.la rlm_sql_mysql.la)cp: target `../lib' is not a directorymake: *** [build-module] Error 1

1 0

FTP Error when Radius is UP
by George Innocent 11 Feb '13

11 Feb '13

Hi; I am using Freeradius on Ubuntu; The authentification part works fine but i am facing challenges when i try to ftp nodes on the network. When the Radius server is UP i get ftp error failure connection on the Nodes but with the Radius off the ftp works. FTP configuration on the Nodes are configured well. What could i be missing -- Regards: George Innocent.

4 5

Any interoperability issues with Aruba and Freeradius
by Alex Sharaz 10 Feb '13

10 Feb '13

Hi All, I'm sure the answer to this is nope, but ... At a recent Aruba training course in amongst the documentation supplied to us were a couple of presentation slides showing different types of eap authentication against recommended RADIUS servers for use with Aruba equipment (Just to be sure the slide heading said Aruba RADIUS Compatibility). The surprising bit was the fact that there was a "No" against Freeradius/TTLS (MD5,TLS,PEAP,LEAP,FAST all were yes) and a coment that said Freeradius also supports TTLS. Now it my well be that the slide is a bit old and just hasn't been updated but it does beg the question have any people using Freeradius with Aruba kit experienced any funnies that needed a specific set of "tweaking" for Aruba? I really can't imaging that it would be the case, but just thought I'd check. Rgds Alex

5 7

PAM authentication not working
by Jaap Winius 10 Feb '13

10 Feb '13

Hi folks, Having managed to get freeradius 2.10 to run on Debian squeeze with a username and password defined in /etc/freeradius/users, I was hoping to take a step forward by getting it to authenticate users through PAM. But, that's not working out as I had hoped. Could sombody please tell me what's missing, or what I'm doing wrong? So far I have done the following: 1.) Copied a set of 4096-bit MD5 SSL certificates that were used in the previous configuration to the /etc/freeradius/certs directory. To generate them, each time I used "LongStringNumberOne" for both the input and output passwords. Among the encryption files generated are ca.pem, dh, server.key and server.pem. The ca.pem file was also copied to my laptop's /etc/certs directory and is used with wpasupplicant for testing the system. 2.) Added the following lines to the end of /etc/freeradius/clients: client 192.168.2.0/24 { secret = LongStringNumberTwo shortname = mynet } 3.) Added the following line to the end of /etc/freeradius/users: DEFAULT Auth-Type = Pam 4.) In /etc/freeradius/eap.conf I changed the values of the following two attributes to: default_eap_type = ttls private_key_password = LongStringNumberOne 5.) In /etc/freeradius/radiusd.conf I changed the value of the following attribute to: user = root 6.) In both /etc/freeradius/sites-enabled/default and /etc/freeradius/sites-enabled/inner-tunnel, I uncommented the "pam" entry in section "authenticate". 7.) Some sources suggest changing it, but I chose to leave the contents of /etc/pam.d/radiusd unmodified: @include common-auth @include common-account @include common-password @include common-session 8.) My NAS is a Linksys is a WRT54GS running DD-WRT v24 firmware and is configured as follows: Wireless Mode AP Wireless Network Mode Mixed Wireless Network Name (SSID) mynet Wireless Channel 6 - 2.437 GHz Wireless SSID Broadcast Enable Network Configuration Bridged Security Mode WPA2 Enterprise WPA Algorithms TKIP+AES RADIUS Server Address 192.168.2.12 RADIUS Server Port 1812 RADIUS Shared Secret LongStringNumberTwo Key Renewal Interval (in sec.) 3600 Unfortunately, after starting the server in debugging mode with "freeradius -X", my client's authentication attempts get rejected and I get the following output from the freeradius server: ========================================= rad_recv: Access-Request packet from host 192.168.2.2 port 1025, id=0, length=245 Cleaning up request 6 ID 0 with timestamp +12 WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0x2ecb21dd28cc340c did not finish! WARNING: !! Please read http://wiki.freeradius.org/ Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! User-Name = "jwinius" NAS-IP-Address = 192.168.2.2 Called-Station-Id = "0014bf72f676" Calling-Station-Id = "00110a81fb2b" NAS-Identifier = "0014bf72f676" NAS-Port = 17 Framed-MTU = 1400 State = 0x2ecb21dd28cc340c8873b5871c637572 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020700701500170301002073bdd7051dfb44f3caccd4c92... Message-Authenticator = 0x6cbe906a70bc7ee95f9ad3365a0471b0 # Executing section authorize from file /etc/freeradius/sites-enabled/ default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "jwinius", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 112 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] eaptls_process returned 7 [ttls] Session established. Proceeding to decode tunneled attributes. [ttls] Got tunneled request EAP-Message = 0x0201001604109f00ed2b3ff2dd5111997f0ba6cee99e FreeRADIUS-Proxied-To = 127.0.0.1 [ttls] Sending tunneled request EAP-Message = 0x0201001604109f00ed2b3ff2dd5111997f0ba6cee99e FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "jwinius" State = 0xdbd7fca1dbd6f80c791225e3340ea6e4 server inner-tunnel { # Executing section authorize from file /etc/freeradius/sites-enabled/ inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "jwinius", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 1 length 22 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 211 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/md5 [eap] processing type md5 rlm_eap_md5: Cleartext-Password is required for EAP-MD5 authentication [eap] Handler failed in EAP/md5 [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. } # server inner-tunnel [ttls] Got tunneled reply code 3 EAP-Message = 0x04010004 Message-Authenticator = 0x00000000000000000000000000000000 [ttls] Got tunneled Access-Reject [eap] Handler failed in EAP/ttls rlm_eap_ttls: Freeing handler for user jwinius [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> jwinius attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 7 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 7 Sending Access-Reject of id 0 to 192.168.2.2 port 1025 EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 ========================================= Any idea what I'm doing wrong? Thanks, Jaap

4 10

Session-Timeout anomalies
by Bill Isaacs 09 Feb '13

09 Feb '13

Hello all, I'm researching this anomaly myself in all the documentation, but thought it would also be helpful both to me and to others to post the problem here. SYMPTOM: Some "Access-Period" accounts (accounts which have X number of seconds to continue logging in and out starting from the very first login) are giving too much time -- that is, at some point they reload the full value of the account type and restart the count down. I discovered it while developing some interface code for our customer service dept. So far, this DOES NOT seem to be happening to all accounts. Moreover, the database info and radclient results are inconsistent on these accounts that ARE showing the anomaly. Here is an example of one such account, a development test account which I created for debugging purposes. It's value is 30 days (2592000 seconds) Radclient result: =============== # echo User-Name="cgitest",User-Password="cgitest" | radclient -c 1 -n 3 -r 3 -t 3 -x 127.0.0.1:1812 auth -S shared Sending Access-Request of id 24 to 127.0.0.1 port 1812 User-Name = "cgitest" User-Password = "cgitest" rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=24, length=26 Session-Timeout = 2366393 =============== sql query: SELECT IFNULL(TIME_TO_SEC(TIMEDIFF(NOW(), MIN(AcctStartTime))),0) FROM radacct WHERE UserName='cgitest' ORDER BY AcctStartTime LIMIT 1 \g +-------------------------------------------------------------------------------------+ | IFNULL(TIME_TO_SEC(TIMEDIFF(NOW(), MIN(AcctStartTime))),0) | +-------------------------------------------------------------------------------------+ | 1447012 | +-------------------------------------------------------------------------------------+ =============== Ok, the problem here should be obvious but I'll explain these results for those who are impatient. The "Session-Timeout" number is way too large. As I stated previously, this is a 30 day account. It was counting down with no problems until a few days ago. It then mysteriously began reporting in the popup window which I was working on that it had 29.9 days left on it, after it had already counted down to something like 15 days. It simply seems to have reloaded itself, even though the sql query reports the accurate number of seconds which have actually expired. (1447012). So if we do the math: 2592000-1447012=1144988 (or roughly 13.25 days) should be the remaining time on this account. Not 27.38 days. Here is the sql counter from sqlcounter.conf: sqlcounter accessperiod { counter-name = Max-Access-Period-Time check-name = Access-Period reply-name = Session-Timeout sqlmod-inst = sql key = User-Name reset = never query = “SELECT UNIX_TIMESTAMP() – UNIX_TIMESTAMP(AcctStartTime) FROM radacct WHERE UserName = ‘%{%k}’ ORDER BY AcctStartTime LIMIT 1″ } (Before anyone bitches about the sql query being different, save your pixels -- no matter which style of query is used, the account reports that it began at the same time, there is truly no issue here that I can see). ALSO, BEFORE YOU ASK: There is only 1 radius server and only 1 sql server on the system. Besides, I have tested this exhaustively using different things like the public IP, the fqdn, etc etc. Results are the same - that is to say, wrong. lol Ok so the question then is: where the hell is radclient getting the notion that the account has 2366393 seconds left? Where is "Session-Timeout" getting this information? Why is it only doing it on some accounts and not others? Any insights would be greatly appreciated. I will post the resolution here (unless one of you smart lads or lasses beats me to it ;) ).

2 10