January 2006 - Freeradius-Users - lists.freeradius.org

rlm_sql_sybase
by Marko Dinic 12 Jan '06

12 Jan '06

Hello, I have set up sql accounting using rlm_sql_sybase driver. This is what the config looks like: sql { driver = "rlm_sql_sybase" # Connect info server = "SOMESERVER" # server symbolic name defined in /opt/sybase/interfaces port = 5000 # port is defined in /opt/sybase/interfaces, so this is not neccessary login = "somelogin" password = "somepassword" # Database table configuration radius_db = "dialin" [...] } First, looking through the rlm_sql_sybase.c, I couldn't find the use of config->sql_db anywhere in the code, so whatever is set as radius_db in sql.conf isn't used in the sybase driver. This means that table names in queries have to be defined as ${radius_db}..tablename While this generally works fine, every time radiusd is started or HUPed, it generates error messages in radius.log that look like this: Thu Jan 12 12:52:10 2006 : Error: Sybase Server message: Thu Jan 12 12:52:10 2006 : Error: number(5701) severity(10) state(2) line(1) Thu Jan 12 12:52:10 2006 : Error: Changed database context to 'master'. These are repeated for each connection to the server. I am in no way Sybase expert, but it seems to me that this happens because the database we want to use is not set. I couldn't find any ctlib example code in which the active database is explicitly chosen, so that I could perhaps produce a patch. Does anybody have any solution to this ? -- Best regards, Marko Dinic, System Engineer ----- YUnet International http://www.eunet.yu Dubrovacka 35/III, 11000 Belgrade Tel: +381 11 311 9901; Fax: + 381 11 311 9901 ----- This e-mail is confidential and intended only for the recipient. Unauthorized distribution, modification or disclosure of its contents is prohibited. If you have received this e-mail in error, please notify the sender by telephone +381 11 311 9901. -----

2 1

x99 Token Module Problems
by David Mitchell 12 Jan '06

12 Jan '06

Greetings, I'm working on using FreeRadius to authenticate to our Cisco devices using CryptoCards. I've run into a couple of snags which I don't think can be fixed easily via configuration but will require code changes. Before I start doing anything code-wise, I wanted to see if anybody knew of a workaround. 1) Our tokens display the response in so-called 'phone number' formatting. FreeRadius knows about 4 different CryptoCard formattings according to x99passwd.sample: d7, d8, h7 and h8. Where a response would be formatted as '12345678' in d8 and '1235678' in d7, our tokens display '123-5678'. I was thinking I would either add a new CC encoding setting or modify the module to ignore dashes. But if there is another way I'd love to hear it. 2) The X99 module, if it is performing a resync, generates a State attribute which the authenticating device is expected to return unadultered in the response packet. However, the value includes NULL values in the middle of it. Our Cisco devices (both IOS and CatalystOS) appear to be using strcpy() or something similar to copy the State attribute and only return the value up to the embedded NULL as a result. Code already exists in the module to generate an ASCII state value, and I was planning on changing the module so that the ASCII value was always used. My reading of the relevant RFC tells me that this is in fact a Cisco bug, but I have not had good luck in the past convincing Cisco that my interpretation of RFC's is more correct than theirs. If you know of a way to work around these without hacking on the code, I'd appreciate knowing about it. Or if you have an opinion about how to best fix the above issues in the code, I'd be interested in that as well. Thanks in advance, -David Mitchell --

2 4

[Auth Problem] FreeRADIUS with GnuGK and ATA
by ByoungJu Jeon 12 Jan '06

12 Jan '06

Hi, I am now in using FreeRADIUS 1.0.5 with ATA 188 v3.1.2 and GunGK 2.2.2_4 on FreeBSD 6.0. When GnuGK send Access Request for ATA, RADIUS reject it. You can check the log from FreeRADIUS as below. When authorization, RADIUS set Auth-Type as CHAP. (In the log, you can see "rlm_chap: Setting 'Auth-Type := CHAP'".) But when authentication, RADIUS set Auth-Type as Reject. (In the log, you can see "rad_check_password: Found Auth-Type Reject".) I don't know why Auth-Type is changed. Could you tell me what I am wrong in configuration? Thanks in advance. Bye. BJ. =========================== The log from FreeRADIUS =========================== rad_recv: Access-Request packet from host 152.102.50.225:64821, id=117, length=145 User-Name = "happian" CHAP-Password = 0x04b3d9e7363592e0e15a4fc9c7ec90e627 CHAP-Challenge = 0x43c44e1a NAS-IP-Address = 152.102.50.225 NAS-Identifier = "Gatekeeper" NAS-Port-Type = Virtual Service-Type = Login-User Framed-IP-Address = 152.102.50.223 Cisco-AVPair = "h323-ivr-out=terminal-alias:happian,0175722139;" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 radius_xlat: '/var/log/radius/radacct//auth-detail-20060111' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct//auth-detail-20060111 modcall[authorize]: module "auth_log" returns ok for request 5 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 5 radius_xlat: 'happian' rlm_sql (sql): sql_set_user escaped user --> 'happian' radius_xlat: 'SELECT id, 'happian', attrname, attrvalue, attrop FROM ??radius_get_check_attrs('happian', NULLIF('152.102.50.223', ' ')::INET, ???CASE ????WHEN '' = '' THEN TRUE ????ELSE FALSE ???END, ???CASE WHEN 'Login-User' = 'Call-Check' THEN TRUE ELSE FALSE EN D, ???'', NULLIF('',''), ???parse_avpair('h323-ivr-out=3Dterminal-alias:happian=2C0175722139=3B', 'h323-ivr-out', 'terminal-alias') ???)' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_postgresql: query: SELECT id, 'happian', attrname, attrvalue, attrop FROM ??radius_get_check_attrs('happian', NULLIF('152.10 2.50.223', '')::INET, ???CASE ????WHEN '' = '' THEN TRUE ????ELSE FALSE ???END, ???CASE WHEN 'Login-User' = 'Call-Check' THEN TRUE E LSE FALSE END, ???'', NULLIF('',''), ???parse_avpair('h323-ivr-out=3Dterminal-alias:happian=2C0175722139=3B', 'h323-ivr-out', 'termi nal-alias') ???) rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = radius_xlat: '' radius_xlat: 'SELECT id, 'happian', attrname, attrvalue, attrop FROM ??radius_get_reply_attrs('happian', NULLIF('152.102.50.223', ' ')::INET, ???CASE ????WHEN '' = '' THEN TRUE ????ELSE FALSE ???END, ???CASE WHEN 'Login-User' = 'Call-Check' THEN TRUE ELSE FALSE EN D, ???'', NULLIF('',''), ???parse_avpair('h323-ivr-out=3Dterminal-alias:happian=2C0175722139=3B', 'h323-ivr-out', 'terminal-alias') ???)' rlm_sql_postgresql: query: SELECT id, 'happian', attrname, attrvalue, attrop FROM ??radius_get_reply_attrs('happian', NULLIF('152.10 2.50.223', '')::INET, ???CASE ????WHEN '' = '' THEN TRUE ????ELSE FALSE ???END, ???CASE WHEN 'Login-User' = 'Call-Check' THEN TRUE E LSE FALSE END, ???'', NULLIF('',''), ???parse_avpair('h323-ivr-out=3Dterminal-alias:happian=2C0175722139=3B', 'h323-ivr-out', 'termi nal-alias') ???) rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = radius_xlat: '' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 5 modcall: group authorize returns ok for request 5 rad_check_password: Found Auth-Type Reject rad_check_password: Auth-Type = Reject, rejecting user auth: Failed to validate the user. Login incorrect: [happian/<CHAP-Password>] (from client Gatekeeper port 0) Sending Access-Reject of id 117 to 152.102.50.225:64821 Finished request 5 ====================================================================== =========================== radiusd.conf =========================== prefix = /usr/local exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/ log_file = ${logdir}/radius.log libdir = ${exec_prefix}/lib pidfile = ${run_dir}/radiusd.pid max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = yes log_auth = yes log_auth_badpass = yes log_auth_goodpass = yes usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 0 status_server = no } proxy_requests = no $INCLUDE ${confdir}/clients.conf snmp = no thread pool { start_servers = 2 max_servers = 5 min_spare_servers = 1 max_spare_servers = 2 max_requests_per_server = 0 } modules { chap { authtype = CHAP } preprocess { with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = yes } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } detail auth_log { detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y%m%d detailperm = 0600 } detail reply_log { detailfile = ${radacctdir}/%{Client-IP-Address}/reply-detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port-Id" } $INCLUDE ${confdir}/postgresql.conf radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { range-start = 192.168.1.1 range-stop = 192.168.3.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no } } instantiate { expr } authorize { preprocess auth_log chap sql } authenticate { Auth-Type CHAP { chap } } preacct { } accounting { acct_unique sql } session { } post-auth { reply_log } pre-proxy { } post-proxy { } =====================================================================

1 1

Re: radutmp bug?
by François Delawarde 12 Jan '06

12 Jan '06

Hi Alan, I might have forgotten to mention that my authentication and accounting mecanism is stricly the same for all my users (coming from the same access server), and the 70 users that were connected at that time had a radutmp "login" entry (and exactly the same logs and mysql entries that I showed for this specific user). Everything had been working well for the last 6 months, I just found this problem weird, but not bothering for my purpose (i can just use mysql entries for management). François. >>=?ISO-8859-1?Q?Fran=E7ois_Delawarde?= <delawarde(a)gmail.com> wrote: >> I noticed today that one user was connected, but missing when I used >> the radwho utility. > The radutmp module requires certain information in order to create a >"login" entry. If that information doesn't exist, it can't create an entry. > Alan DeKok.

1 0

About the acquisition method of certificate information
by Kouji Amemiya 12 Jan '06

12 Jan '06

Hi, I'm using FreeRADIUS 1.0.5 and JRadius on Windows XP now. I want to know FreeRADIUS function. I use JRadius and I'm performing cooperation with FreeRADIUS. Then, in some cases, I want to teach one point. I think that I want to acquire the serial number of the certificate used by TLS authentication. Is this information unacquirable via eap_tls? Best Regards, Kouji Amemiya -- Kouji Amemiya <amemiya(a)allied-telesis.co.jp>

1 0

kerberos authentication
by Riccardo.Veraldi 12 Jan '06

12 Jan '06

Hello, I am trying kerberos authentication. I configured the radiusd.conf Auth-Type Kerberos { krb5 } .... krb5 { keytab = /etc/krb5.keytab #service_principal = } than in users DEFAULT Auth-Type := Kerberos But I am unable to succesfully authenticate and I get this error: rlm_krb5: Attribute "User-Password" is required for authentication. How could I Solve this problem? I would like the authentication via 802.1x to point to my kerberos server instead of a local radius users file authentication (this indeed works with EAP-TTLS). What am I doing wrong ? should I instead use PAM module and configure PAM to authenticate using kerberos ? thanks very much Rick

2 2

FreeRadius & Cisco Pix Auth
by James Taylor 11 Jan '06

11 Jan '06

Hello everyone. I am trying to use AAA for remote VPN access on a Pix 515E firewall. The following shows a debug of what I am seeing on the Radius Server during the Auth process. Not sure as to why the Radius server is sending an access-reject after it verifies that my user is valid and should be authenticated for remote access. Any pointers would be greatly appreciated. Thank you. James Taylor rad_recv: Access-Request packet from host 192.168.42.1:1025, id=62, length=94 User-Name = "jtaylor" NAS-IP-Address = 192.168.42.1 User-Password = "*********" NAS-Port = 49 Cisco-AVPair = "ip:source-ip=192.168.43.250" rlm_ldap: - authorize rlm_ldap: performing user authorization for jtaylor rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: (re)connect to intranet.corp.laszlosystems.com:389, authentication 0 rlm_ldap: bind as cn=Manager,dc=laszlosystems,dc=com/Laszl0 to intranet.corp.laszlosystems.com:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: Added password ********** in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user jtaylor authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 rad_recv: Access-Request packet from host 192.168.42.1:1025, id=63, length=94 Sending Access-Reject of id 62 to 192.168.42.1:1025

3 4

v1.0.1 segfault, also 1.0.5
by gezick 11 Jan '06

11 Jan '06

hi. i had been hapilly running 1.0.1 for quite some time, until today it stopped. this is bad. radiusd would sefault each time that it tried to process a request. i did a make clean;make and got a compile error, so i downloaded the newest code (1.0.5) and did the ./configure;make;make install dance. that all worked. when i ran 1.0.5, i got the same segfault i was getting from 1.0.1 i don't know if anything has changed on the server (it shouldn't have, but i won't know for sure until later, but it looks like it did). can anyone take a look at the strace and let me know if there's anything illuminating in there that i am missing? uname -a says "Linux bentham.ispvip.biz 2.6.6-mm5 #3 SMP Sun May 23 15:27:38 EDT 2004 x86_64 x86_64 x86_64 GNU/Linux" the strace (all 1000 lines) is at http://pastebin.com/501123 thanks. gezick

2 1

freeradius 1.0.4 + mysql cannot authincate
by Jonathan Carpenter 11 Jan '06

11 Jan '06

I am running freeradius 1.0.4 + mysql 4.1.16. I have use the mysql database schema from the freeradius tar ball. Everything seems to be setup correctly I can authenticate from flat text files but not from any database usernames. Here is the output from my /usr/sbin/radiusd -X: Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1645 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "before" main: lower_pass = "no" main: nospace_user = "before" main: nospace_pass = "before" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Listening on authentication *:1645 Listening on accounting *:1646 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32784, id=125, length=58 User-Name = "scooby" User-Password = "scooby" NAS-IP-Address = 255.255.255.255 NAS-Port = 10 rad_lowerpair: User-Name now 'scooby' rad_rmspace_pair: User-Name now 'scooby' rad_rmspace_pair: User-Password now 'scooby' auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [scooby/scooby] (from client localhost port 10) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 125 to 127.0.0.1:32784 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 125 with timestamp 43c3dc9c Nothing to do. Sleeping until we see a request. Here is my syntax for radtest: radtest scooby scooby localhost:1645 10 secret My entries in the mysql table radcheck: mysql> select * from radcheck; +----+----------+---------------+----+----------+ | id | UserName | Attribute | op | Value | +----+----------+---------------+----+----------+ | 1 | scooby | User-Password | := | scooby | +----+----------+---------------+----+----------+ Do I have my information specified wrong in my database or not enough information in my database? I can not figure out why I get authentications errors when running radtest. I am not sure where I should specify the auth-type. Any help would be appreciated. Thanks, -- Jonathan Carpenter Linux System Administrator Windows System Administrator <The Unix Geek>

9 12

possible ascend data filter problems
by Chuck 11 Jan '06

11 Jan '06

i have been working with our upstream dialup provider for a week now and he has come to the conclusion that freeradius is passing the data as ascii rather than abinary. his tests used flat files while we use mysql. the filters we define are listed below from our support tech's email: -------------------------------------- That too did not change anything. In my testing If I just plug the ascend attributes in my users file as follows Ascend-data-filter += "ip in forward tcp est", Ascend-data-filter += "ip in forward dstip 64.113.34.0/24", Ascend-data-filter += "ip in drop tcp srcport = 80", Ascend-data-filter += "ip in drop tcp dstport = 25", Ascend-data-filter += "ip in forward", And they translate to Abinary fine. This leads me to believe it has to do with the way sql is passing it to you radius server. ----------------------------------- any idea why /how this is happening? it is affecting our entire structure since we are also a proxy for approx 25 realms and it affects many of their setups too. these need to be passed to our upstream as abinary. -- Chuck

2 5