July 2005 - Freeradius-Users - lists.freeradius.org

Calling-Station-ID not sent by pam_radius_auth.
by Christiaan Ehlers 25 May '11

25 May '11

Hi I currently running the following system: Server: FreeRadius, MySQL Client: pam_radius_auth, libnss_mysql.so I use the freeradius to auth and account ssh logins, here is my pam.d/sshd file on the client. #%PAM-1.0 auth sufficient /lib/security/pam_radius_auth.so debug auth required /lib/security/pam_stack.so service=system-auth auth required /lib/security/pam_nologin.so account sufficient /lib/security/pam_radius_auth.so debug account required /lib/security/pam_stack.so service=system-auth password required /lib/security/pam_stack.so service=system-auth session required /lib/security/pam_mkhomedir.so skel=/etc/skel/ umask=0022 session sufficient /lib/security/pam_radius_auth.so debug conf=/etc/radiusclient/servers session required /lib/security/pam_stack.so service=system-auth session required /lib/security/pam_limits.so session optional /lib/security/pam_console.so Now when I authenticate I can see that the Calling-Station-ID gets passed, but when I do authentication that field seems to be missing. Here is the output of radiusd -X Ready to process requests. rad_recv: Access-Request packet from host 10.0.0.1:3698, id=220, length=89 User-Name = "test" User-Password = "123pass" NAS-IP-Address = 10.0.0.1 NAS-Identifier = "sshd" NAS-Port = 2673 NAS-Port-Type = Virtual Service-Type = Authenticate-Only Calling-Station-Id = "10.1.1.1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'test' rlm_sql (sql): sql_set_user escaped user --> 'test' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'test' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 7 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupche ck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'test' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'test' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgrouprep ly.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'test' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 7 modcall[authorize]: module "sql" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type pap auth: type "PAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_pap: login attempt by "test" with password 123pass rlm_pap: Using password "$1$n/uxpq.r$FBKqAEC8KvsK13QVHRwAf/" for user test authentication. rlm_pap: Using CRYPT encryption. rlm_pap: User authenticated succesfully modcall[authenticate]: module "pap" returns ok for request 0 modcall: group Auth-Type returns ok for request 0 Sending Access-Accept of id 220 to 10.0.0.1:3698 Framed-IP-Address := 10.1.1.1 Framed-Protocol := PPP Service-Type := Framed-User Framed-Compression := Van-Jacobson-TCP-IP Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Accounting-Request packet from host 10.0.0.1:3698, id=66, length=72 User-Name = "test" NAS-IP-Address = 10.0.0.1 NAS-Identifier = "sshd" NAS-Port = 2673 NAS-Port-Type = Virtual Acct-Status-Type = Start Acct-Session-Id = "00002673" Acct-Authentic = RADIUS Processing the preacct section of radiusd.conf modcall: entering group preacct for request 1 modcall[preacct]: module "preprocess" returns noop for request 1 rlm_acct_unique: Hashing 'NAS-Port = 2673,Client-IP-Address = 10.0.0.1,NAS-IP-Address = 10.0.0.1,Acct-Session-Id = "00002673",User-Name = "test"' rlm_acct_unique: Acct-Unique-Session-ID = "a0ec8ab13c262f56". modcall[preacct]: module "acct_unique" returns ok for request 1 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 1 modcall[preacct]: module "files" returns noop for request 1 modcall: group preacct returns ok for request 1 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 1 radius_xlat: '/usr/local/var/log/radius/radacct/10.0.0.1/detail-20050603' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/10.0.0.1/detail-20050603 modcall[accounting]: module "detail" returns ok for request 1 modcall[accounting]: module "unix" returns ok for request 1 radius_xlat: '/usr/local/var/log/radius/radutmp' radius_xlat: 'test' modcall[accounting]: module "radutmp" returns ok for request 1 radius_xlat: 'test' rlm_sql (sql): sql_set_user escaped user --> 'test' radius_xlat: 'INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('00002673', 'a0ec8ab13c262f56', 'test', '', '10.0.0.1', '2673', 'Virtual', '2005-06-03 14:20:01', '0', '0', 'RADIUS', '', '', '0', '0', '', '', '', '', '', '', '', '0')' rlm_sql (sql): Reserving sql socket id: 6 rlm_sql (sql): Released sql socket id: 6 modcall[accounting]: module "sql" returns ok for request 1 modcall: group accounting returns ok for request 1 Sending Accounting-Response of id 66 to 10.0.0.1:3698 Finished request 1 Going to the next request Cleaning up request 1 ID 66 with timestamp 42a05901 Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 220 with timestamp 42a05901 Nothing to do. Sleeping until we see a request. As you can see the CallingStationId is empty, also there is no mention of it in the Accounting request packet. If this is not supported by the accounting, is there a way to get it from the authentication section? Would also like to say that I know this is more related to the PAM module and I assume this makes this mail a bit out of context in this mail group, but any help would be most appreciated. Kind Regards Christiaan Ehlers

4 3

no DB handles
by Lucas Aimaretto 31 Oct '07

31 Oct '07

Hi all, I've seen many of these messages in the radius.log ... Wed Jun 15 15:10:23 2005 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 What does it mean ? How to solve this ? Best regards, Lucas -- No virus found in this outgoing message. Checked by AVG Anti-Virus. Version: 7.0.323 / Virus Database: 267.7.3/15 - Release Date: 14/06/2005

11 23

Freeradius and PPPoe Server ?
by Dumpfbacke 102731 12 Sep '05

12 Sep '05

Hello, I search a HowTo for Freeradius+PPPoe. MFG. -- 5 GB Mailbox, 50 FreeSMS http://www.gmx.net/de/go/promail +++ GMX - die erste Adresse f�r Mail, Message, More +++

5 5

rlm_ldap: Attribute "User-Password" is required for authentication
by melvin 09 Aug '05

09 Aug '05

Hi all, Currently I need to use ldap to authenticate my users and I keep encountering the same problem "rlm_ldap: Attribute "User-Password" is required for authentication". I have tried adding "checkItem User-Password userPassword" into ldap.attrmap but it still doesn't work. Anyone have any ideas how I can enable radius to authenticate thru ldap? rlm_ldap: - authenticate rlm_ldap: Attribute "User-Password" is required for authentication. modcall[authenticate]: module "ldap" returns invalid for request 0 modcall: group Auth-Type returns invalid for request 0 auth: Failed to validate the user. cheers, melvin

4 12

Question on sql.conf -> accounting_start_query <-> accounting_start_query_alt
by Andreas Engler 08 Aug '05

08 Aug '05

Hello, to prevent duplicate entries in the radacct table, shouldn't the accounting_start_query be the "UPDATE" query and the accounting_start_query_alt be the "INSERT into" query as it is the case on stop and update. In which case would the accounting_start_query fail and the accounting_start_query_alt work? Could someone point me in the right direction? I know, that freeradius manages handled retransmitted Acct-Requests, so duplicate entries only would show up if at some point it wouldn't remember. I don't know if this is impossible. Thank you. Andreas

3 4

Question about Freeradius for mobile device authentication
by Jasper Jans 05 Aug '05

05 Aug '05

Hi, I've been asked to setup a platform for mobile device authentication. I'm looking into setting up Freeradius with a MySQL backend for this. The request that has been been is to verify users on three items: - msisdn - username - password My question is - can this authentication be done in different ways for different groups of users. Say group A wants the unique combination of msisdn, username, password to grant them access - however group B wants a pool of msisdns that are valid for all of their username + password combinations. If someone could be so kind as to maybe give an example of how to do this it would be greatly appreciated. Thanks, - Jasper

3 3

huntgroups/groups with sql
by Michel Jansens 02 Aug '05

02 Aug '05

Hi, I want to use FR to control the access to different ressources (radius clients). I've put my users in 'radcheck', defined groups in 'radgroupcheck' according to Client-IP-Address and put the users in their groups in 'usergroup'. Some users are in more than one group, but they can only access to the first matching group defined in 'radgroupcheck'. Tryed to add 'Fall-Through = Yes' to all 'radgroupcheck' entries, but it didn't work. Now I've found a workaround: I added a column 'groupIPaddr' varchar(15) in 'radgroupcheck'. I put there the Client-IP-Address and changed the query in sql.conf to: authorize_group_check_query = "SELECT ${groupcheck_table}.id,${groupcheck_table}.GroupName, ${groupcheck_table}.Attribute,${groupcheck_table}.Value, ${groupcheck_table}.op FROM ${groupcheck_table},${usergroup_table} WHERE ${groupcheck_table}.groupIPaddr ='%{Client-IP-Address}' AND ${usergroup_table}.Username = '%{SQL-User-Name}' AND ${usergroup_table}.GroupName = ${groupcheck_table}.GroupName ORDER BY ${groupcheck_table}.id" Now My users have access to all their authorized nasses whatever the order of definition of the groups. Was there an easier/more standard way of doing? Michel

2 1

Disconnect-Request packet
by N White 01 Aug '05

01 Aug '05

Ok. I am trying to figure out how to disconnect a user, or to tell the radius server to send a disconnect packet to the NAS for a specific user. This is the command I am using: echo "User-Name = nickwhite" | radclient 192.168.1.1 disconnect mysecret -x This is the debug output from the radius server: ad_recv: Disconnect-Request packet from host 192.168.1.2:47874, id=139, length=31 Unknown packet code 40 from client 192.168.1.2:47874 - ID 139 : IGNORED I also came across this: http://www.freeradius.org/faq/#4.3 But why then is there a command as part of radclient to disconnect, and what does that response exactly mean. Is there any way to accomplish this?(disconnecting a user via radclient?) Thanks -- --------------------------- | Nick White | | nwtech(a)tele-net.net | ---------------------------

5 11

access-challenge
by Srinivasa Rao Chigurupati 01 Aug '05

01 Aug '05

Hi 1. Will FreeRadius challenges with access-challenge if auth-type is PAP? If answer is it depends on some configuration, how to configure it? 2. How FreeRadius understands incoming Radius access-request packet contains PAP authentication information, CHAP authentication information or MS-CHAP authentication information or other authentication information? -- Thanks Srinivasa Rao Chigurupati

2 3

WRT54GS (sveasoft) with Freeradius 1.0.2
by Rajeev Pokkyarath 01 Aug '05

01 Aug '05

Hello! I am trying to use Linksys WRT54GS with Firmware_Alchemy-6.0rc3lw031 (sveasoft) against my freeradius server (1.0.2). Basically trying to setup a hotspot scenario. But eventhough I enter a valid username/password in the login page, I am not able to login. I ran the radius server in the debug mode and I see that the server is sending the Access-Accept packet (I also notice that it is re-sending it). Instead of my freeradius server, I tested against the server hosted by chillispot, (https://radius.chillispot.org/radius/) (freeradius?) and it seems to be working fine. Any thoughts that might lead me to the right direction? or any known issues? Cheers! ____________________________________________________ Start your day with Yahoo! - make it your home page http://www.yahoo.com/r/hs

2 1