freeradius and winbind stop to work

[Victor Hugo dos Santos]

Hello,

I have a problem with a freeradius + samba and ntlm authetication.
the configuration work very well and without problems for a random
period of time, but after 2, 4, 7 days, the freeradius stop to work
and only work again if I restart the service (/etc/init.d/freeradius
restart).

in the same machine, I have a samba file server (connected to a
domain) and winbindd service... both still working without problems.

I have this packages installed

======================
 dpkg -l | egrep '(winb|samba|freeradius)'
ii  freeradius                          2.1.12+dfsg-1.2ubuntu8.1
      amd64        high-performance and highly configurable RADIUS
server
ii  freeradius-common                   2.1.12+dfsg-1.2ubuntu8.1
      all          FreeRADIUS common files
ii  freeradius-utils                    2.1.12+dfsg-1.2ubuntu8.1
      amd64        FreeRADIUS client utilities
ii  libfreeradius2                      2.1.12+dfsg-1.2ubuntu8.1
      amd64        FreeRADIUS shared library
ii  libnss-winbind:amd64                2:4.3.9+dfsg-0ubuntu0.14.04.3
      amd64        Samba nameservice integration plugins
ii  libwbclient0:amd64                  2:4.3.9+dfsg-0ubuntu0.14.04.3
      amd64        Samba winbind client library
ii  python-samba                        2:4.3.9+dfsg-0ubuntu0.14.04.3
      amd64        Python bindings for Samba
ii  samba                               2:4.3.9+dfsg-0ubuntu0.14.04.3
      amd64        SMB/CIFS file, print, and login server for Unix
ii  samba-common                        2:4.3.9+dfsg-0ubuntu0.14.04.3
      all          common files used by both the Samba server and
client
ii  samba-common-bin                    2:4.3.9+dfsg-0ubuntu0.14.04.3
      amd64        Samba common files used by both the server and the
client
ii  samba-dsdb-modules                  2:4.3.9+dfsg-0ubuntu0.14.04.3
      amd64        Samba Directory Services Database
ii  samba-libs:amd64                    2:4.3.9+dfsg-0ubuntu0.14.04.3
      amd64        Samba core libraries
ii  samba-vfs-modules                   2:4.3.9+dfsg-0ubuntu0.14.04.3
      amd64        Samba Virtual FileSystem plugins
ii  winbind                             2:4.3.9+dfsg-0ubuntu0.14.04.3
      amd64        service to resolve user and group information from
Windows NT servers
======================

on
======================
# cat /etc/lsb-release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=14.04
DISTRIB_CODENAME=trusty
DISTRIB_DESCRIPTION="Ubuntu 14.04.4 LTS"
======================



and in log file I found this (why the logs dont have the time for default ??)

===================================
# Executing group from file /etc/freeradius/sites-enabled/inner-tunnel
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/mschapv2
[eap] processing type mschapv2
[mschapv2] # Executing group from file
/etc/freeradius/sites-enabled/inner-tunnel
[mschapv2] +- entering group MS-CHAP {...}
[mschap] No Cleartext-Password configured.  Cannot create LM-Password.
[mschap] No Cleartext-Password configured.  Cannot create NT-Password.
[mschap] Creating challenge hash with username: operador
[mschap] Told to do MS-CHAPv2 for operador with NT-Password
[mschap] FAILED: No NT/LM-Password.  Cannot perform authentication.
[mschap] FAILED: MS-CHAP2-Response is incorrect
++[mschap] returns reject
[eap] Freeing handler
++[eap] returns reject
Failed to authenticate the user.
[peap] Tunneled authentication was rejected.
[peap] FAILURE
++[eap] returns handled
Finished request 788.
Going to the next request
Thread 4 waiting to be assigned a request
Waking up in 0.9 seconds.
Thread 5 got semaphore
Thread 5 handling request 789, (158 handled so far)
[<thread>] # Executing section authorize from file
/etc/freeradius/sites-enabled/default
[<thread>] +- entering group authorize {...}
[<thread>] ++- entering policy filter_hostname {...}
[<thread>] +++? if (User-Name =~ /^host/)
[<thread>] ? Evaluating (User-Name =~ /^host/) -> FALSE
[<thread>] +++? if (User-Name =~ /^host/) -> FALSE
[<thread>] ++- policy filter_hostname returns notfound
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "operador", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 10 length 43
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7
[peap] Done initial handshake
[peap] eaptls_process returned 7
[peap] EAPTLS_OK
[peap] Session established.  Decoding tunneled attributes.
[peap] Peap state send tlv failure
[peap] Received EAP-TLV response.
[peap]  The users session was previously rejected: returning reject (again.)
[peap]  *** This means you need to read the PREVIOUS messages in the
debug output
[peap]  *** to find out the reason why the user was rejected.
[peap]  *** Look for "reject" or "fail".  Those earlier messages will tell you.
[peap]  *** what went wrong, and how to fix the problem.
[eap] Handler failed in EAP/peap
[eap] Failed in EAP select
++[eap] returns invalid
Failed to authenticate the user.
Using Post-Auth-Type Reject
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group REJECT {...}
[attr_filter.access_reject]     expand: %{User-Name} -> operador
attr_filter: Matched entry DEFAULT at line 11
++[attr_filter.access_reject] returns updated
Delaying reject of request 789 for 1 seconds
Going to the next request
Thread 5 waiting to be assigned a request
Waking up in 0.9 seconds.
Waiting to send Access-Reject to client red-gasco port 36995 - ID: 19
Sending delayed reject for request 789
Waking up in 3.9 seconds.
===================================


any help or idea ?

thanks and attentive


-- 
--
Victor Hugo dos Santos
http://www.vhsantos.net
Linux Counter #224399