October 2005 - Freeradius-Users - lists.freeradius.org

FreeRADIUS - FreeBSD - Segmentation fault
by Christian Meutes 04 Oct '05

04 Oct '05

Hi Alan and others, are there any new findings in context to the problem with FreeRADIUS(rlm_sql_mysql?) > 1.0.4 under FreeBSD? I have just tested it with FreeBSD5.4-Release and FreeRADIUS out of the ports and the problem still exists: --- rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to freeradius@127.0.0.1:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 Segmentation fault (core dumped) --- > "Thomas Krause (Webmatic)" <tk(a)webmatic.de> wrote: >> I tried both, version 1.0.4 (from ports) and 1.0.5 - and both crashed. >> Also I tried with mysql 4.0.26 with the same result. > > It looks like the bug exists *only* on FreeBSD. For the life of me, > I can't figure out why. > > Alan DeKok. > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > Christian Meutes systems engineer -- claranet gmbh internet service provider tel +49 (0) 69 - 40 80 18 - 300 email: christian.meutes(a)de.clara.net http://www.claranet.de/

3 3

freeradius and MS SQL -- anyone got it working?
by Arne Götje (高盛華) 04 Oct '05

04 Oct '05

Hi list, What is the status of MS SQL support for freeradius? Did anyone get it working? And if yes, which version do you use and what is required to get it work? I'm currently using freeradius 1.0.2 on Debian Sarge and I didn't manage to get it connect to the MS SQL server. As the rlm_sql_freetds module states that it is under development ans so, not enabled by default, I was wondering, if the iODBC or the unixodbc modules would work and if yes, how to set this up (aside from freeradius.. seems the 'drivers' are missing, whatever this means). Need some help here. Anyone? Cheers Arne -- Arne Götje (高盛華) <arne(a)linux.org.tw> PGP/GnuPG key: 1024D/685D1E8C Fingerprint: 2056 F6B7 DEA8 B478 311F 1C34 6E9F D06E 685D 1E8C Key available at wwwkeys.pgp.net. Encrypted e-mail preferred.

4 7

RE: MSCHAPv2, MySQL, Freeradius
by Dan Russell 04 Oct '05

04 Oct '05

> -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius- > users-bounces(a)lists.freeradius.org] On Behalf Of Alan DeKok > Sent: Tuesday, 4 October 2005 3:17 PM > To: FreeRadius users mailing list > Subject: Re: MSCHAPv2, MySQL, Freeradius > > "Dan Russell" <dan(a)in-house.com.au> wrote: > > > Because you put it into the NT-Password attribute, instead of the > > > User-Password attribute. > > > > Okay, I've tried that and not found it to work for me. > > Sorry, it *does* work. Since you didn't provide any debug logs or > config examples, I can only suggest that you probably did it wrong. > Hey, I'm not having a go at you, I believe it does work, I'm just having issue getting it working.. Here is the log of someone attempting to log in : rad_recv: Access-Request packet from host x.x.x.x:32775, id=33, length=177 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 422 NAS-Port-Type = Ethernet User-Name = "wolfer" Calling-Station-Id = "00:50:FC:68:E6:32" NAS-Port-Id = "ether2" MS-CHAP-Challenge = 0x700b1e514cb6628c25441cb76ce17109 MS-CHAP2-Response = 0x010051c12db8db344c7c72d03bda36fd556d000000000000000076fb28d715a538d4ae 05b012cd5edb6e86ee71d8f6d6bbc0 NAS-Identifier = "NAS" NAS-IP-Address = x.x.x.x Tue Oct 4 15:10:39 2005 : Debug: Processing the authorize section of radiusd.conf Tue Oct 4 15:10:39 2005 : Debug: modcall: entering group authorize for request 5 Tue Oct 4 15:10:39 2005 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 5 Tue Oct 4 15:10:39 2005 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 5 Tue Oct 4 15:10:39 2005 : Debug: modcall[authorize]: module "preprocess" returns ok for request 5 Tue Oct 4 15:10:39 2005 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 5 Tue Oct 4 15:10:39 2005 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 5 Tue Oct 4 15:10:39 2005 : Debug: modcall[authorize]: module "chap" returns noop for request 5 Tue Oct 4 15:10:39 2005 : Debug: modsingle[authorize]: calling sql (rlm_sql) for request 5 Tue Oct 4 15:10:39 2005 : Debug: radius_xlat: 'wolfer' Tue Oct 4 15:10:39 2005 : Debug: rlm_sql (sql): sql_set_user escaped user --> 'wolfer' Tue Oct 4 15:10:39 2005 : Debug: radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'wolfer' ORDER BY id' Tue Oct 4 15:10:39 2005 : Debug: rlm_sql (sql): Reserving sql socket id: 4 Tue Oct 4 15:10:39 2005 : Debug: radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgrou pcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'wolfer' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' Tue Oct 4 15:10:39 2005 : Debug: radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'wolfer' ORDER BY id' Tue Oct 4 15:10:39 2005 : Debug: radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgrou preply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'wolfer' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' Tue Oct 4 15:10:39 2005 : Info: rlm_sql (sql): No matching entry in the database for request from user [wolfer] Tue Oct 4 15:10:39 2005 : Debug: rlm_sql (sql): Released sql socket id: 4 Tue Oct 4 15:10:39 2005 : Debug: modsingle[authorize]: returned from sql (rlm_sql) for request 5 Tue Oct 4 15:10:39 2005 : Debug: modcall[authorize]: module "sql" returns notfound for request 5 Tue Oct 4 15:10:39 2005 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 5 Tue Oct 4 15:10:39 2005 : Debug: rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = MS-CHAP' Tue Oct 4 15:10:39 2005 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 5 Tue Oct 4 15:10:39 2005 : Debug: modcall[authorize]: module "mschap" returns ok for request 5 Tue Oct 4 15:10:39 2005 : Debug: modcall: group authorize returns ok for request 5 Tue Oct 4 15:10:39 2005 : Debug: rad_check_password: Found Auth-Type MS-CHAP Tue Oct 4 15:10:39 2005 : Debug: auth: type "MS-CHAP" Tue Oct 4 15:10:39 2005 : Debug: Processing the authenticate section of radiusd.conf Tue Oct 4 15:10:39 2005 : Debug: modcall: entering group Auth-Type for request 5 Tue Oct 4 15:10:39 2005 : Debug: modsingle[authenticate]: calling mschap (rlm_mschap) for request 5 Tue Oct 4 15:10:39 2005 : Debug: rlm_mschap: No User-Password configured. Cannot create LM-Password. Tue Oct 4 15:10:39 2005 : Debug: rlm_mschap: No User-Password configured. Cannot create NT-Password. Tue Oct 4 15:10:39 2005 : Debug: rlm_mschap: Told to do MS-CHAPv2 for wolfer with NT-Password Tue Oct 4 15:10:39 2005 : Debug: rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. Tue Oct 4 15:10:39 2005 : Debug: rlm_mschap: FAILED: MS-CHAP2-Response is incorrect Tue Oct 4 15:10:39 2005 : Debug: modsingle[authenticate]: returned from mschap (rlm_mschap) for request 5 Tue Oct 4 15:10:39 2005 : Debug: modcall[authenticate]: module "mschap" returns reject for request 5 Tue Oct 4 15:10:39 2005 : Debug: modcall: group Auth-Type returns reject for request 5 Tue Oct 4 15:10:39 2005 : Debug: auth: Failed to validate the user. Tue Oct 4 15:10:39 2005 : Auth: Login incorrect: [wolfer/<no User-Password attribute>] (from client build port 422 cli 00:50:FC:68:E6:32) Tue Oct 4 15:10:39 2005 : Debug: Delaying request 5 for 1 seconds Tue Oct 4 15:10:39 2005 : Debug: Finished request 5 Tue Oct 4 15:10:39 2005 : Debug: Going to the next request Tue Oct 4 15:10:39 2005 : Debug: --- Walking the entire request list --- Tue Oct 4 15:10:39 2005 : Debug: Waking up in 1 seconds... Tue Oct 4 15:10:40 2005 : Debug: --- Walking the entire request list --- Tue Oct 4 15:10:40 2005 : Debug: Waking up in 1 seconds... rad_recv: Access-Request packet from host x.x.x.x:32775, id=33, length=177 Sending Access-Reject of id 33 to x.x.x.x:32775 Here is a snippet of the radcheck table : ID UserName Attribute op Value 25 wolfer SMB-Account-CTRL == 16 27 wolfer NT-Password == 0x47C8F8E50C470E37AAD3B435B51404EE Any help? Thanks for any help in advance, Daniel Russell > > It tries to get the 'User-Password' attribute first (which it fails on, > > I don't have one), then it tried to get the 'LM-Password' attribute > > which it also fails on. After dealing with that it tries the same thing > > with 'NT-Password'. For some reason it isn't pulling these attributes > > out of mysql.. > > Read the debug log. It will tell you what it *is* getting from MySQL. > > > After looking at the debug output from freeradius, the sql statement > > that it executes when it receives an authentication request should > > return the LM-Password and NT-Password. > > Does it return those attributes when you run the query by hand? > > Alan DeKok. > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

2 1

rlm_eap(peap):unknown error
by Kouji Amemiya 04 Oct '05

04 Oct '05

Hi, I am using FreeRADIUS-1.0.5 under cygwin. I used "./configure --without-snmp --disable-shared --enable-static" option. I started "radiusd -f -X", "unknown error" occured. Log and eap.conf are shown below. $ radiusd -f -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "/usr/local/etc/raddb/newcerts/" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/newcerts/serverkey.pem" tls: certificate_file = "/usr/local/etc/raddb/newcerts/servercert.pem" tls: CA_file = "/usr/local/etc/raddb/newcerts/cacert.pem" tls: private_key_password = "bbbb" tls: dh_file = "/usr/local/etc/raddb/newcerts/dh" tls: random_file = "/usr/local/etc/raddb/newcerts/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls rlm_eap: Failed to link EAP-Type/peap: unknown error radiusd.conf[9]: eap: Module instantiation failed. //////////////////// // eap.conf eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no md5 { } leap { } gtc { auth_type = PAP } tls { private_key_password = bbbb private_key_file = ${raddbdir}/newcerts/serverkey.pem certificate_file = ${raddbdir}/newcerts/servercert.pem CA_file = ${raddbdir}/newcerts/cacert.pem dh_file = ${raddbdir}/newcerts/dh random_file = ${raddbdir}/newcerts/random CA_path = ${raddbdir}/newcerts/ } peap { default_eap_type = mschapv2 } mschapv2 { } } However, "radiusd -f -X" is successful when "default_eap_type = peap" is changed into "default_eap_type = md5" and "peap" secion is commented out. If some may be understood, please let me know. Best Regards.

2 1

Postgresql+freeradius configuration
by msah＠otitelecom.bj 04 Oct '05

04 Oct '05

Good morning!!!!! I have successfully configured freeradius server with using postgresql database to storage users which i want to authenticate. when i put it in debug mode to test he works well. But when I run it as deamon the server radius don't see the postgresql server. In the radius's log file i look this: Driver rlm_sql_postgresql (module rlm_sql_postgresql) loaded and linked Info: rlm_sql (sql): Attempting to connect to radiusadmin@localhost:/radiusdb Error: rlm_sql_postgresql: Couldn't connect socket to PostgreSQL server radiusadmin@localhost:radiusdb Error: rlm_sql_postgresql: Postgresql error 'could not connect to server: Permission denied ?Is the server running on host "localhost" and accepting ?TCP/IP connections on port 5432? ' Error: rlm_sql (sql): Failed to connect DB handle #0 Info: Ready to process requests. Please help me.

4 3

accounting in syslog
by Marc-Henri Boisis-delavaud 04 Oct '05

04 Oct '05

Is it possible to generate accounting message for syslog ? Marc

1 0

question on dialup_admin
by radius.unime＠email.it 04 Oct '05

04 Oct '05

Hello! I have a question on dialup_admin: I have configured freeradius to authorization by LDAP and authentication by EAP and it works fine. Now I want to log the activity of my users with dialup_admin, it's necessary that I use sql for authentication and authorization? or I can use EAP and LDAP again and dialup_admin only for log? If yes, I must add the entry in the database (mysql) for any user that can access to my network? excuse me for my bad english... Thanks, Felice -- Email.it, the professional e-mail, gratis per te: http://www.email.it/f Sponsor: Occhialeria.it Scopri le migliori marche a prezzi imbattibili Clicca qui: http://adv.email.it/cgi-bin/foclick.cgi?mid=879&d=20051003

2 1

Re: Control user logins by NAS
by Christian Meutes 04 Oct '05

04 Oct '05

Create a group in your sql database, then assign the the users to this group and give the group a check-item. insert into radgroupcheck (GroupName,Attribute,op, Value) values ('your_group_name',NAS-IP-Address','==','ip_address'); If you want that a group can itself successfully authenticate through connect from more than one nas, i think you have to define all nas's with a negated operator '!=' from that the group/user is NOT allowed to connect/authenticate. > Hi all, > > How can I control what groups can authenticate on what nas. > I would like to create a batch of users and assign those users to only > sucessfully login from a particular nas (or list of nas's) > I have freeradius 1.04 and use sql for the user/password combinations > > Group 30 mins > Simultanious Use := 1 > Idle Timeout = 600 > Max All Sessions := 1800 > > It is a wireless hotspot setup. > Do I need to use huntgroups or can I add an attribute to the group? > > > Thanks in advance > > Shane > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > >

2 1

RE: MSCHAPv2, MySQL, Freeradius
by Dan Russell 04 Oct '05

04 Oct '05

> -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius- > users-bounces(a)lists.freeradius.org] On Behalf Of Alan DeKok > Sent: Monday, 3 October 2005 2:48 PM > To: FreeRadius users mailing list > Subject: Re: MSCHAPv2, MySQL, Freeradius > > "Dan Russell" <dan(a)in-house.com.au> wrote: > > >> If I used a third party tool like mkntpwd to create NT Hashes, could > > I > > >> put premade hashes in the database and use them to authenticate > ... > > Is there any specific config change I would need to make to enable this? > > No. It should work in the default config. > > > How does freeradius identify that the password has already been NT > > hashed? > > Because you put it into the NT-Password attribute, instead of the > User-Password attribute. > Okay, I've tried that and not found it to work for me. I looked through the source code to the rlm_mschap now and have found where I believe it is falling over. It tries to get the 'User-Password' attribute first (which it fails on, I don't have one), then it tried to get the 'LM-Password' attribute which it also fails on. After dealing with that it tries the same thing with 'NT-Password'. For some reason it isn't pulling these attributes out of mysql.. After looking at the debug output from freeradius, the sql statement that it executes when it receives an authentication request should return the LM-Password and NT-Password. When I try to authenticate it gives me the error : " rlm_mschap: No User-Password configured. Cannot create LM-Password." " rlm_mschap: No User-Password configured. Cannot create NT-Password." And a couple of lines later I get " rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication." I'm not sure why it isn't picking the attributes up.. If its any help, I'm using mysql 4.1.11 and freeradius 1.0.2 > > What stops it from encrypting whatever it finds in the radcheck table > > for the password? > > I have no idea what question you're asking. So far as I can tell, > the answer is "it doesn't work that way". > > Alan DeKok. > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

2 1

FreeRadius Logging Abilities
by Chuck 03 Oct '05

03 Oct '05

I am totally lost here. I am getting this type entry in my radius.log listing the radius server contacting us. Sat Oct 1 12:05:07 2005 : Auth: Login OK: [user@domain] (from client upstream-radius5 port 7490 cli 2199340456) and I have a lot of useless (to us) account log directories in the radacct logging directory. What I want to do is lower the amount of detail in the accounting logs to a single file that can be rotated or just do away with it. We run 90% as a proxy server anyway, and the accounting tables in the database provide us with any reports we need. What i want to see in radius.log is an entry like this showing the nas-ip host/node name instead of radius client: Fri Sep 30 20:04:37 2005: Auth: Login OK: [user@domain] (from nas nas5.tempe1.az.us.da.qwest.net/S7428) socket 0 (0 sec) I have searched through the examples and text in every config file in the /etc/raddb and cannot find a way to accomplish this. The FreeRadius logging options look quite powerful so I am assuming there is a reasonably easy way of doing this that I am missing and/or not comprehending. I tried commenting out the detail area to eliminate accounting logs, but then radius complained bitterly about not having a detail section. Any clues how to accomplish this goal? The wanted format for radius.log is an absolute must. The entire log is useless to us showing the contacting radius client. We need to know the network node they dialed into. -- Chuck

2 2