I've been having the same problem lately. Restarting the smbd, winbind, and radius services does not solve the problem, only rebooting. Thomas E. Casartello, Jr. Staff Assistant - Wireless/Linux Administrator Information Technology Wilson 105A Westfield State College -----Original Message----- From: freeradius-users-bounces+tcasartello=wsc.ma.edu@lists.freeradius.org [mailto:freeradius-users-bounces+tcasartello=wsc.ma.edu@lists.freeradius.org ] On Behalf Of Gary Gatten Sent: Tuesday, April 20, 2010 6:30 PM To: 'FreeRadius users mailing list' Subject: RE: freeradius authentication stops working after some time... Have you read the changelog between 2.1.0 and 2.1.8? Maybe there's a known bug? I've had issues where some part of SAMBA dies (winbind/nmbd/smbd) and of course Auth will also fail, but if all the SAMBA pieces are working and FR is running, it usually just works! Maybe run in debug mode until it dies and hopefully catch something interesting. G -----Original Message----- From: freeradius-users-bounces+ggatten=waddell.com@lists.freeradius.org [mailto:freeradius-users-bounces+ggatten=waddell.com@lists.freeradius.org] On Behalf Of Thomas Munck Steenholdt Sent: Tuesday, April 20, 2010 5:22 AM To: freeradius-users@lists.freeradius.org Subject: freeradius authentication stops working after some time... Hi List... I've been having this strange issue, that I hope somebody in here will be able to assist me in solving. I have a Linux machine (Ubuntu 9.10, 32 bit), running freeradius 2.1.0 (ubuntu 9.10 version, but re-built with ssl), setup to provide authentication services for a wireless network using ntlm against a Windows 2008 AD. On fresh reboot of the machine, everything works just fine. After some time, though, things start to fail (I'm not sure exactly how long it works, or even if the working period of time is the same every time, but I'd say roughly a days time). Even when authentication is failing, wbinfo -t and ntlm_auth appears to be working and freeradius is still running. But it starts logging "Auth: Login incorrect:" errors. Restarting the server makes things work again - every time. Any idea where to look? Thanks in advance. /Thomas - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Has anyone else seen a problem with this? This is starting to happen more commonly with me. I'm having to reboot the server that Freeradius runs on to get the authentication working again. I'm using AD auth through Winbind....Here is the debug... Machine authentication is properly configured. When I reboot it, this same authentication is successful. The strange thing is is that a reboot is necessary. Just restarting radius, winbind, and smbd doesn't cut it...... rad_recv: Access-Request packet from host 172.20.4.253 port 32769, id=165, length=329 User-Name = "host/basestar.ads.wsc.ma.edu" Calling-Station-Id = "00-21-5c-7d-71-fd" Called-Station-Id = "00-21-d7-90-64-10:s-wsc" NAS-Port = 29 NAS-IP-Address = 172.20.4.253 NAS-Identifier = "abbott-wism-b" Airespace-Wlan-Id = 4 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "491" EAP-Message = 0x020b007b19001703010070abe23d0799f55b545cee42461dd141d17c72c67cb2dabd470668 441eaec01a8266d6d4f36f751270037d895acddc86660b043ce05bf1f2bd3788e0d72bc3ed10 cb62242f62cb3227d4141974651832f49a1a9003f46db1f1de9b12e13c4372ff3bebd05b274f c4ca2a60dcb3ce47a80b State = 0x1d035cd3150845bae32ebc5933237cec Message-Authenticator = 0x77259c5c45ce8c9a600ee9e9f9120e52 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "host/basestar.ads.wsc.ma.edu", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] No '\' in User-Name = "host/basestar.ads.wsc.ma.edu", looking up realm NULL [ntdomain] No such realm "NULL" ++[ntdomain] returns noop [eap] EAP packet type response id 11 length 123 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020b00571a020b005231dbfe5edcdb81d9452effcb46478d712d0000000000000000c133d8 84067c2ea1fff7a04fef31119b91de14974498a8e000686f73742f62617365737461722e6164 732e7773632e6d612e656475 server { PEAP: Setting User-Name to host/basestar.ads.wsc.ma.edu Sending tunneled request EAP-Message = 0x020b00571a020b005231dbfe5edcdb81d9452effcb46478d712d0000000000000000c133d8 84067c2ea1fff7a04fef31119b91de14974498a8e000686f73742f62617365737461722e6164 732e7773632e6d612e656475 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "host/basestar.ads.wsc.ma.edu" State = 0x6498913564938b9115406469a8f16067 server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "host/basestar.ads.wsc.ma.edu", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] No '\' in User-Name = "host/basestar.ads.wsc.ma.edu", looking up realm NULL [ntdomain] No such realm "NULL" ++[ntdomain] returns noop ++[control] returns noop [eap] EAP packet type response id 11 length 87 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 13 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv2 for host/basestar.ads.wsc.ma.edu with NT-Password [mschap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [mschap] ... expanding second conditional [mschap] expand: %{mschap:User-Name:-None} -> basestar$ [mschap] expand: --username=%{Stripped-User-Name:-%{mschap:User-Name:-None}} -> --username=basestar$ [mschap] mschap2: a7 [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=9e1c53abac5d5f70 [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=c133d884067c2ea1fff7a04fef31119b91de14974498a8e0 Exec-Program output: NT_KEY: 07241CE38653EA3AEBF9A1F92A945380 Exec-Program-Wait: plaintext: NT_KEY: 07241CE38653EA3AEBF9A1F92A945380 Exec-Program: returned: 0 [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010c00331a030b002e533d3241323844453432324345383245414531453633324144333538 3141304238443644383443303631 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6498913565948b9115406469a8f16067 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010c00331a030b002e533d3241323844453432324345383245414531453633324144333538 3141304238443644383443303631 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6498913565948b9115406469a8f16067 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 165 to 172.20.4.253 port 32769 EAP-Message = 0x010c005b19001703010050b9cc4946916158a9cc76c97e8ea8072014edda81414c6cfc1f4d 89147ee419fb9d9f624e2737b751db9eea008fd0b613d42ac1d903696d9897e801e96f323eb5 346ce82bd5e4bced9cf8af66d7684d53 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1d035cd3140f45bae32ebc5933237cec Thomas E. Casartello, Jr. Staff Assistant - Wireless/Linux Administrator Information Technology Wilson 105A Westfield State College -----Original Message----- From: freeradius-users-bounces+tcasartello=wsc.ma.edu@lists.freeradius.org [mailto:freeradius-users-bounces+tcasartello=wsc.ma.edu@lists.freeradius.org ] On Behalf Of Bruce Nunn Sent: Wednesday, June 02, 2010 9:39 AM To: FreeRadius users mailing list Subject: Re: freeradius authentication stops working after some time... I run 2.1.8, server 2008 R2 and samba 3.5.2. It's something to do with winbind, but I have not nailed it down on my installation yet. Sent via Verizon Wireless -----Original Message----- From: "Casartello, Thomas" <tcasartello@wsc.ma.edu> Date: Wed, 2 Jun 2010 08:28:23 To: 'FreeRadius users mailing list'<freeradius-users@lists.freeradius.org> Subject: RE: freeradius authentication stops working after some time... - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html