January 2006 - Freeradius-Users - lists.freeradius.org

SQL Authentication (mainly @Alan!)
by florian broder 06 Jan '06

06 Jan '06

Hi. Some weeks ago I was asking for this, but didn't receive an answer. Subject is MySQL Authentication based on a Calling-Station-ID. The problem is, that the cisco Switch doesn't send a user-name&user-password in his access-request, and mysql doesn't like! --> *Error: rlm_sql *>* (sql): zero length username not permitted" I tried to comment out this part in the sql-module source-code, and recompile freeradius. To my surprise, this actually DOES work. --> rad_recv: Access-Request packet from host 127.0.0.1:1046, id=134, length=52 User-Name = "" User-Password = "michael" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'michael' rlm_sql (sql): sql_set_user escaped user --> 'michael' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck ? WHERE Username = 'michael' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'michael' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'michael' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'michael' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type Accept rad_check_password: Auth-Type = Accept, accepting the user Sending Access-Accept of id 134 to 127.0.0.1:1046 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 134 with timestamp 43bc1274 Nothing to do. Sleeping until we see a request. Sql.conf was told, to check for the password, not username. It works! So, my question is, like in the subject, mainly directed to alan, or some other developper of the sql-module. WHY was it done like that, i.e. that you HAVE to use a username in sql? Thanks for your help, I really appreciate it! Bye.*

1 0

Re: acct_unique
by Velikanov 06 Jan '06

06 Jan '06

I now about Auth-Type, Autz-Type, Acct-Type, Session-Type and the sections where to use them. What "ZZZZ-Type" must i use in "preacct" section ? THANKS > "Velikanov" <alex(a)asu.farlep.net> wrote: > > preacct { > > preprocess > > Acct-Type PIX{ > > acct_PIX > > } > > You put an "Acct-Type" in a "preacct" section. That won't work. > Acct-Types have to go into "accounting" sections. > > > radiusd.conf[1683] Unknown module rcode 'acct_PIX'. > > It's treating "Acct-Type" as a module name, because Acct-Types don't > belong in "preacct" sections. > > Alan DeKok.

2 1

Test
by Mathieu Clément 05 Jan '06

05 Jan '06

Please answer if it works!!!!

2 1

before freeradius, openssl don't work
by pelusa vali 05 Jan '06

05 Jan '06

hi everybody, well still trying to use freeradius for a wlan. i use debian sarge kernel 2.6.13, openssl 0.9.8.a to generate certificates and last freeradius version. well i followed many tutorials about securing wlans with freeradius and all of them have this step: openssl rsa <newreq.pem > servidor-key.pem but when i type this my system returns: unable to load Private Key 5237:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:644:Expecting: ANY PRIVATE KEY so i think it's a problem with rsa generation and tried to generate rsa key but always get same error. i know it's not a list of openssl but i posted this question in openssl list and nobody ask; searched in internet and nothing; so, any body could help?? what is happening and how could i solve this?? excuse if this so trivial but i'm new with both, openssl and freeradius and don't understand what is happening and why. thanks in advance for your time and help. _________________________________________________________________ MSN Amor: busca tu ½ naranja http://latam.msn.com/amor/

1 0

RE: Fw: authorize and authenticate methods ina custom module
by Susana Macias 05 Jan '06

05 Jan '06

Thanks a lot Alan, I would like to explain what I am trying to develop. If someone has any advise, please tell me. This is my scenario: Until now, we have a RADIUS server (RADIUS PSI) which only receives Access-Request packets. Also we have a CGI application located in the URL http://X.Y.Z.W:8080/nucleo This application receives a set of parameters as an URL encoded string (all characters that are not a-z, A-Z or 0-9 are converted to their "URL escaped" version) with this form: Attribute1=Value1&Attribute2=Value2... (where Attribute1, Attribute2... and Value1,Value2... are the differents Attribute/Value pairs obtained from the Access-Request packet) The CGI application consults a remote database (and normally authenticate the user using the telephone number; although there are other variants). According to the response obtained from the remote resource, the RADIUS server adds differents Attribute/Value pairs to the reply list, and always reply with an Access-Accept packet (whether or not the CGI application authenticate the user successfully) Now, we want to change to a FreeRadius server. I only want to call the remote resource (using the libcurl library) passing it the appropiates parameters and collect the information returned by it in order to create the reply list. As the CGI application performs the authorize and authenticate activities I am a little embarrassed to say that I am not sure which function should I implement (authorize or authenticate). Thank you very much in advance Best wishes, Susana ----- Original Message ----- From: "Alan DeKok" To: "FreeRadius users mailing list" Sent: Tuesday, January 03, 2006 4:31 PM Subject: Re: authorize and authenticate methods ina custom module > Susana Macias wrote: > > I have started working with the RADIUS protocol (and with FreeRadius > > in particular) three weeks ago. Congratulations for the product, it is > > really powerful! > > Thanks. > > > But, when are the authorize() and authenticate() methods called? > > When a packet comes in. See doc/aaa.txt > > > Is it necessary to include in the radiusd.conf the name of the > > instance (of the new module created) in the authorize section in order > > to call its authorize() method? > > Yes. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > --------------------------------- Correo Yahoo! Comprueba qué es nuevo, aquí http://correo.yahoo.es

2 1

LDAP scope
by Stefan Adams 05 Jan '06

05 Jan '06

Hi! Is it possible to specify a basedn of "dc=example,dc=com" with a scope of "sub" so that my search filters can apply to both "ou=People" and "ou=Computers" for example? It seems from my testing that the scope is "one" by default. The reason I would like to do this is to have the check box in Windows XP that says "Authenticate as computer..." checked. Doing this, FreeRADIUS is first presented with the credentials of the computer (host/name). Since I already have a computer account in ou=Computers, I figure I'd just add a cn=host/name attribute and modify the filter to be (|(uid=%{User-Name})(cn=%{User-Name})). But this can only work with a basedn of "dc=example,dc=com" and a scope of sub. Thanks! Stefan

2 1

Failed to link to module 'rlm_exec': /usr/local/lib/rlm_exec.a: invalid ELF header
by Mathieu Clément 05 Jan '06

05 Jan '06

Good morning, Look at this: --------------------------------------------------------------- # radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib radiusd.conf[1383] Failed to link to module 'rlm_exec': /usr/local/lib/rlm_exec.a: invalid ELF header -------------------------------------------- Running mandrake with mysql. Second question: How to add users in the mysql table ? I see "UserName, value, etc." but where to put the password, and which format (md5 ? sha1 ? cleared-text ?) Thank you in advance, Have a good day. Mathieu --- avast! Antivirus: message Sortant propre. Base de donnÚes des virus (VPS): 0601-1, 03/01/2006 Test du: 05/01/2006 02:47:50 avast! - copyright (c) 1988-2004 ALWIL Software. http://www.avast.com

1 1

acct_unique
by Velikanov 05 Jan '06

05 Jan '06

Good day. I need to use such a construction in radiusd.conf acct_unique acct_std{ key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } acct_unique acct_PIX{ key = "Acct-Session-Id, NAS-IP-Address, Login-IP-Host, Login-TCP-Port" } preacct { preprocess Acct-Type PIX{ acct_PIX } acct_std } BUT got an error when i do "radiusd -X": .......... .......... Module: Instantiated sql (sql) radiusd.conf[1683] Unknown module rcode 'acct_PIX'. In radiusd.conf there are the strings: string 1682: Acct-Type PIX{ string 1683: acct_PIX string 1684: } WHERE IS MY MISTAKE ? And a questions - Why we need to use attribute "Acct-Unique-Session-Id" ? I use sql database for accounting, there we have unique index "radacctid" and i need to understand the purpose and advantages of using the attribute "Acct-Unique-Session-Id" THANKS

2 1

NAS-identifier instead of IP-identifier
by Rob Cleminson 05 Jan '06

05 Jan '06

Hello, I am new to freeradius and need a little help.... We are going to be deploying a bunch of Wireless Routers all over the place and they may have DHCP addresses on them instead of static WAN addresses..When a client associates to our Wireless Router they are redirected to the Radius Server which then creates a secure session onto the internet(WPA etc) Is there a way of identifying the router to our FreeRadius server without having a static IP address on each Router? Cheers Rob

3 2

In which point does the FR sever send the Access-Accept or Access-Reject packet?
by Marta Lajas 05 Jan '06

05 Jan '06

Hy all, I have a doubt about when FreeRadius server decides to send an Access-Accept or an Access-Reject packet. When the authenticate module returns with a RLM_MODULE_REJECT, does the FR server send an Access-Reject packet? or does it occur later? When the authenticate module returns with a RLM_MODULE_OK, does the FR server send the Access-Accept packet? or does it occur later? Thanks in advance, Marta --------------------------------- Correo Yahoo! Comprueba qué es nuevo, aquí http://correo.yahoo.es

3 2