August 2005 - Freeradius-Users - lists.freeradius.org

Using a database schema other than the one created by db_mysql.sql
by Ana Bizarro 02 Aug '05

02 Aug '05

Hi, We have a (mysql) database where we have usernames and passwords and I recently installed freeradius on our server. I would like the freeradius server to authenticate using the database but, obviously, our database schema is completely different than the one created by db_mysql.sql. All the documentation (and examples) I've seen so far mention the db_mysql.sql script (even in the RADIUS book) and I was wondering, if it's possible to use our own database, how do I tell RADIUS that "uid" in the users table is the username and "pwd" is the password? For the tables names, I'm assuming I can just change the sql.conf file and replace whatever is inside " " by our own table names Like: usergroup_table = "usergroup" replace by usergroup_table = "users" Thanks, -Ana

3 2

Accounting to db, duplicate entries (again)
by Roger Kristiansen 02 Aug '05

02 Aug '05

Hi, I'm having some problems with Alive messages that follow immediately after Start messages. Sometimes this causes two entries with the same acctuniqeid to be entered into the database, the only thing separating the two being a few hundreds of a second on the acctstarttime field. I find this behaviour rather annoying, and as I mentioned in an earlier mail, that was confirmed by Alan DeKok, it is cause by the following: 1) Receives a Start packet and inserts a new entry/session in the db 2) Receives Alive packet _immediately_ after the Start packet, and queries the database to see if the unique-session-id already exists. 3) The query doesn't return anything, since postgresql hasn't had time to complete the INSERT-query for the Start packet, and accounting_update_query_alt is thus run. I'm not at all experienced with databases, but I was thinking I could lock the accounting table while inserting the Start message, so that the query in pnt. 2 could not be performed until the Insert in pnt. 1 is finished. Wouldn't this elminate the problem in pnt. 3? How does freeradius react to a situation like this.. does it keep trying to perform the SELECT query in 2 until it succeds, or is the Alive packed just dropped? If the latter is the case, does anyone here know if I can make postgresql queue requests that get blocked because of the lock? Anyone else had this problem, and if so, how did you get around it, if you got around it at all? Any pointers would be highly appreciated :) Regards, Roger Kristiansen

2 1

accounting records per nasid, not ip address
by freeradius＠puchol.com 02 Aug '05

02 Aug '05

hi, this is my first time using freeradius. had a good experience so far. i had to coerce the latest cvs version into fedora core 3 with more hacks than i would have liked, but that's ok, it's up and running. one issue i find so far is that my NASs have a dynamic ip. i managed this externally at great pains, however, for the purposes of radius accounting, i'd like to see the accounting records on a per-nasid file in /var/log/radius/radacct/<nasid> rather than what i see now as: /var/log/radius/radacct/<ip-address> i could not find a simple way to do this by looking around, though i may be missing something. is this doable as-is? if not, any hint on where to hack this would be greatly appreciated. while i am on the list, and at the risk of irking someone i would like to (lazily) ask if anyone knows offhand where can i find a document that i saw a few months back on "hardening" radiusd. the process exited on me a couple of times due to dynamic ip issues, creating multi-hour blackouts that i rather not see again. looking for freeradius hardening or crashing i cannot seem to find that most excellent list of things to restart or manage a crashed server. thanks in advance!

4 5

Access-reject tiemout
by Patrice TCHERKEZIAN 02 Aug '05

02 Aug '05

Hi !, I experiment a strange problem which have appeared since some weeks. All Access-Reject sent to my AC/AP by the radius server take a lot of time to arrive and there is a timeout on my AC/AP. This is very strange because all Access-Accept are well-received without any timeout and any error by the AC/AP. And, I test on my lan with Ntradping, and the same problem of timeout appears after an Access-Reject. But also, when I launch Freeradius on debug mode, there is no timeout and all Access-Reject are well-received. This is the configuration I use : freeradius 1.0.3 database : Postgresql release 8.0.3 Access Controller/Access Point colubris(CN3200) Thank you for your help. Sincerily, Patrice Tcherkezian ------------------------------------------------------------ Below, an debug output with a successful connection : ------------------------------------------------------------ rad_recv: Access-Request packet from host 192.168.10.60:2631, id=8, length=48 User-Name = "estelle" CHAP-Password = 0x438c4b60518a10782d6e01d0cf399bdc14 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "estelle", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 radius_xlat: 'estelle' rlm_sql (sql): sql_set_user escaped user --> 'estelle' radius_xlat: 'SELECT radcheck.id, radcheck.UserName, radcheck.Attribute, radcheck.Value, radcheck.Op ??FROM radcheck , "user" ??WHERE radcheck.Username = 'estelle' AND radcheck.Username = "user".Username AND "user".state_account = 1 ??ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = radius_xlat: 'SELECT radgroupcheck.id, radgroupcheck.GroupName, ??radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op ??FROM radgroupcheck, usergroup ??WHERE usergroup.Username = 'estelle' AND usergroup.GroupName = radgroupcheck.GroupName ??ORDER BY radgroupcheck.id' rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = radius_xlat: 'SELECT id, UserName, Attribute, Value, Op ??FROM radreply ??WHERE Username = 'estelle' ??ORDER BY id' rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = radius_xlat: 'SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, ??radgroupreply.Value, radgroupreply.Op ??FROM radgroupreply,usergroup ??WHERE usergroup.Username = 'estelle' AND usergroup.GroupName = radgroupreply.GroupName ??ORDER BY radgroupreply.id' rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied CHAP-Password matches local User-Password Login OK: [estelle] (from client postedario port 0) Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 0 rlm_sql (sql): Processing sql_postauth radius_xlat: 'estelle' rlm_sql (sql): sql_set_user escaped user --> 'estelle' radius_xlat: 'INSERT into radpostauth (username, pass, reply, authdate,mac_address,ip_user,hotspot_name) ??values ('estelle', 'Chap-Password', 'Access-Accept', NOW(),'', NULLIF('', '')::inet,'')' rlm_sql (sql) in sql_postauth: query is INSERT into radpostauth (username, pass, reply, authdate,mac_address,ip_user,hotspot_name) ??values ('estelle', 'Chap-Password', 'Access-Accept', NOW(),'', NULLIF('', '')::inet,'') rlm_sql (sql): Reserving sql socket id: 3 rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: affected rows = 1 rlm_sql (sql): Released sql socket id: 3 modcall[post-auth]: module "sql" returns ok for request 0 modcall: group post-auth returns ok for request 0 Sending Access-Accept of id 8 to 192.168.10.60:2631 Session-Timeout := 4813 Idle-Timeout := 600 Framed-Protocol := PPP Service-Type := Framed-User Framed-MTU := 1500 Colubris-AVPair += "use-access-list=visiteurs" Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... ------------------------------------------------------------ Below, an debug output with a refused connection : ------------------------------------------------------------ rad_recv: Access-Request packet from host 192.168.10.60:2638, id=9, length=46 User-Name = "voila" CHAP-Password = 0x4f2988cb3ca0e0e7bfd22eea9dda72b19f Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "voila", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 radius_xlat: 'voila' rlm_sql (sql): sql_set_user escaped user --> 'voila' radius_xlat: 'SELECT radcheck.id, radcheck.UserName, radcheck.Attribute, radcheck.Value, radcheck.Op ??FROM radcheck , "user" ??WHERE radcheck.Username = 'voila' AND radcheck.Username = "user".Username AND "user".state_account = 1 ??ORDER BY id' rlm_sql (sql): Reserving sql socket id: 2 rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = rlm_sql (sql): User voila not found in radcheck radius_xlat: 'SELECT radgroupcheck.id, radgroupcheck.GroupName, ??radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op ??FROM radgroupcheck, usergroup ??WHERE usergroup.Username = 'voila' AND usergroup.GroupName = radgroupcheck.GroupName ??ORDER BY radgroupcheck.id' rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = radius_xlat: 'SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, ??radgroupreply.Value, radgroupreply.Op ??FROM radgroupreply,usergroup ??WHERE usergroup.Username = 'voila' AND usergroup.GroupName = radgroupreply.GroupName ??ORDER BY radgroupreply.id' rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = rlm_sql (sql): User voila not found in radgroupcheck rlm_sql (sql): User not found rlm_sql (sql): Released sql socket id: 2 modcall[authorize]: module "sql" returns notfound for request 1 modcall: group authorize returns ok for request 1 rad_check_password: Found Auth-Type CHAP auth: type "CHAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 1 rlm_chap: login attempt by "voila" with CHAP password rlm_chap: Could not find clear text password for user voila modcall[authenticate]: module "chap" returns invalid for request 1 modcall: group Auth-Type returns invalid for request 1 auth: Failed to validate the user. Login incorrect (rlm_chap: Clear text password not available): [voila/<CHAP-Password>] (from client postedario port 0) Processing the post-auth section of radiusd.conf modcall: entering group Post-Auth-Type for request 1 rlm_sql (sql): Processing sql_postauth radius_xlat: 'voila' rlm_sql (sql): sql_set_user escaped user --> 'voila' radius_xlat: 'INSERT into radpostauth (username, pass, reply, authdate,mac_address,ip_user,hotspot_name) ??values ('voila', 'Chap-Password', 'Access-Reject', NOW(),'', NULLIF('', '')::inet,'')' rlm_sql (sql) in sql_postauth: query is INSERT into radpostauth (username, pass, reply, authdate,mac_address,ip_user,hotspot_name) ??values ('voila', 'Chap-Password', 'Access-Reject', NOW(),'', NULLIF('', '')::inet,'') rlm_sql (sql): Reserving sql socket id: 1 rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: affected rows = 1 rlm_sql (sql): Released sql socket id: 1 modcall[post-auth]: module "sql" returns ok for request 1 modcall: group Post-Auth-Type returns ok for request 1 Delaying request 1 for 1 seconds Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 9 to 192.168.10.60:2638 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 9 with timestamp 42efb05d Nothing to do. Sleeping until we see a request.

2 1

Session-Timeout zero value
by Rashad Rustamoff 02 Aug '05

02 Aug '05

I'm wonder is it correct to reject user by setting Session-Timeout attribute to zero. In case of our NAS it works fine.

2 1

RE: mod_radius, apache2 and the auth cookie.
by Palmer J.D.F. 02 Aug '05

02 Aug '05

Hi, > Was was pointed out, you'll get authentication dialogs for every gif > & jpg on the page. This is a BAD idea. The gifs etc are located in an unprotected directory, surely this prevents from having to re-authenticate for each? > > > If I get a failed login, then try to login again it just uses cached > > credentials and doesn't prompt for details, if I close and re-open the > > browser it does then allow me to enter details. > > Then your browser is broken. Firefox and Opera are also broken in that case. :-( A bit of a dig around reveals this from the Apache site, which implies that all browsers cache the credentials. http://httpd.apache.org/docs/howto/auth.html#basicfaq Thanks, Jezz Palmer.

3 2

Re: Freeradius-Users Digest, Vol 4, Issue 5
by David Barker - 4D Internet Ltd 02 Aug '05

02 Aug '05

Please note that as of the 1st August 2005 my email address changed to dbarker(a)4dtechnologygroup.com. Your email has been forwarded onto my new address but please update your address book for future use. Thank you. David Barker 4D Internet Limited http://www.4dtechnologygroup.com

1 0

Fwd: PEAP + linksysWRT54G not working
by alfred hitch 02 Aug '05

02 Aug '05

Hi All, I was having a very simple network for testing, WIN XP (SP2) client, connecting via a wireless router . in PEAP MSCHAPv2 Mode .. Now, everything was working fine with no issues while I was using a D-Link AP, I replaced it with a Linksys Router (WRT54G) and boom boom bang !!!! .. I cannot get even basic WPA-TKIP RADIUS to work. (Btw, My Win XP PEAP is set for asking for credentials and not default use windows domain and password. no server certificate validation ) My observations: Issue 1: After wireless association, router send EAPOL-req. Identiy, 1) If I enter credentials, say pradeep/pradeep .. they go to radius.. logs attached .. radius sends a challenge to router. router doesnt seem to be forwarding this ! 2) If I change above PEAP setting to use domain name .. the exchange goes through but fails at the last step, saying no password found. Issue 2: Even if I assume that linksys is somehow looking for "\\" in incoming username requests, I was trying to configure radius for that. And here is where I need critical help. Is just entering the username in this format in users file ok ? SBNOTEBOOK\\Administrator Auth-Type := Local, User-Password == "sbook" SB_Uplink = 10, SB_Downlink = 20, Session-Timeout = 600, Fall-Through = 0 I have tried all combinations here with "\" instead of "\\" .. turning on with_nt_domain_hack = yes in conf file. I am new and am sure I am missing something very basic here, any help would be appreciated. I am attaching a log from Issue1, step2 and radiusd.conf. Cheers, Alfred

1 0

Disconnect-Request packet
by N White 01 Aug '05

01 Aug '05

Ok. I am trying to figure out how to disconnect a user, or to tell the radius server to send a disconnect packet to the NAS for a specific user. This is the command I am using: echo "User-Name = nickwhite" | radclient 192.168.1.1 disconnect mysecret -x This is the debug output from the radius server: ad_recv: Disconnect-Request packet from host 192.168.1.2:47874, id=139, length=31 Unknown packet code 40 from client 192.168.1.2:47874 - ID 139 : IGNORED I also came across this: http://www.freeradius.org/faq/#4.3 But why then is there a command as part of radclient to disconnect, and what does that response exactly mean. Is there any way to accomplish this?(disconnecting a user via radclient?) Thanks -- --------------------------- | Nick White | | nwtech(a)tele-net.net | ---------------------------

5 11

Re: XP supplicant and Secure Cerficate acceptance
by David Mitton 01 Aug '05

01 Aug '05

I think your terminology is incorrect. I know for a fact that Funk's software will not accept a self-signed cert. That is a certificate not signed by another CA. What I think you meant, was a having your own private trusted CA root. Where the server and client certs are signed by it. And, yes, in that configuration you have to install the cert for that CA on the clients, if you want them to verify the server cert. If you can provide me a pointer to the Funk documentation that recommends what you suggest, I would appreciate it. Dave. ----- Original Message ----- From: "Josh Howlett" <Josh.Howlett(a)bristol.ac.uk> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Subject: Re: XP supplicant and Secure Cerficate acceptance Date: Mon, 1 Aug 2005 21:53:16 +0100 (BST) > > On Mon, 1 Aug 2005, jck-freeradius(a)southwestern.edu wrote: > > > I am running FreeRadius 1.0.4 and using XP supplicants. My problem > > is after authenticating against FreeRadius, XP asks me to OK > > the server certificate. > > > > I do not want to manually validate the server certificate. XP should be able > > to validte the certificate by itself, as long as the cert has been issued by > > a valid Certificate Authority. I have tried using certs from DigiCert and > > Verisign. > > Hi, > > In an 802.1x context, it is best to use certs from a self-signed CA, rather > than a well-known CA (such as Verisign). > > This is because an attacker could dupe your users' supplicants by acquiring a > certificate from the same CA that you trust (ie. Verisign), and install a > rogue WAP near your premises to steal inner-tunnel credentials. > > There is a solution, and this is to get the supplicant to verify certain > attributes within the server cert. However, I am aware of only one supplicant > that can do this: Funk's Odyssey. FWIW, even Funk recommend using a > self-signed CA. > > Evidentally, you'll need to distribute the CA's root certificate to your users. > > josh. > > > - List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

2 1