November 2006 - Freeradius-Users - lists.freeradius.org

Re: Freeradius-Users Digest, Vol 19, Issue 38
by Marilene Lima 16 Nov '06

16 Nov '06

Hi, Thanks a lot for the response. But I have two problems. The first is my english: I am Brazilian and I might not write in english very well... ; ) The second and more important problem is this: I configured my freeradius server, I can authenticate with my users ldap... but I configured my mysql server too, but I can't to authenticate with the mysql users... the access is denied... even when the user and password is correct... ho I think that the server isn't looking for my users in mysql database. Someone knows how I can to test if the freeradius is looking for my users in my mysql database too? Thanks a lot, Marilene

2 1

problem with freeeradius, mysql setup
by Alexandru Matei 16 Nov '06

16 Nov '06

Hi all, I have some problems setting up Freeradius 1.1.3, with mysql 3.23.54 on Redhat9. Here's the log for radiusd (relevant part): Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32769, id=216, length=57 User-Name = "test1" User-Password = "password" NAS-IP-Address = 255.255.255.255 NAS-Port = 500 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "test1", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 radius_xlat: 'test1' rlm_sql (sql): sql_set_user escaped user --> 'test1' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'test1' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'test1' ORDER BY id radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'test1' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'test1' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'test1' ORDER BY id' rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'test1' ORDER BY id radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'test1' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'test1' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): Released sql socket id: 4 rlm_sql (sql): No matching entry in the database for request from user [test1] modcall[authorize]: module "sql" returns notfound for request 0 modcall: leaving group authorize (returns ok) for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 216 to 127.0.0.1 port 32769 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 216 with timestamp 4559bead Nothing to do. Sleeping until we see a request. On the mysql front all seems good: mysql -u dialup_admin -ppassword -D radius Reading table information for completion of table and column names You can turn off this feature to get a quicker startup with -A Welcome to the MySQL monitor. Commands end with ; or \g. Your MySQL connection id is 134 to server version: 3.23.54-log Type 'help;' or '\h' for help. Type '\c' to clear the buffer. mysql> SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'test1' ORDER BY id; +----+----------+---------------+----------+----+ | id | UserName | Attribute | Value | op | +----+----------+---------------+----------+----+ | 3 | test1 | User-Password | password | := | +----+----------+---------------+----------+----+ 1 row in set (0.00 sec) mysql> SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'test1' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id; +----+-----------+------------------+-------+----+ | id | GroupName | Attribute | Value | op | +----+-----------+------------------+-------+----+ | 1 | retea | Simultaneous-Use | 1 | = | | 2 | retea | Auth-Type | Local | := | +----+-----------+------------------+-------+----+ 2 rows in set (0.01 sec) mysql> SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'test1' ORDER BY id; +----+----------+--------------------+----------------+----+ | id | UserName | Attribute | Value | op | +----+----------+--------------------+----------------+----+ | 7 | test1 | Framed-Compression | NONE | = | | 8 | test1 | Service-Type | Framed | = | | 10 | test1 | Framed-IP-Address | 193.226.57.105 | = | | 11 | test1 | Framed-IP-Netmask | 255.255.255.0 | = | | 12 | test1 | Framed-MTU | 1492 | = | +----+----------+--------------------+----------------+----+ 5 rows in set (0.00 sec) mysql> SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'test1' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id; +----+-----------+-------------------+-----------------+----+ | id | GroupName | Attribute | Value | op | +----+-----------+-------------------+-----------------+----+ | 1 | retea | Framed-Protocol | PPP | = | | 2 | retea | Port-Limit | 1 | = | | 3 | retea | Framed-IP-Address | 255.255.255.254 | = | | 4 | retea | Framed-MTU | 1492 | = | | 5 | retea | Service-Type | Framed | = | +----+-----------+-------------------+-----------------+----+ 5 rows in set (0.01 sec) Do you have any idea why is it failing? Thanks, Alex

3 5

help on pppd chap authorize by freeradius
by Alexandru Matei 16 Nov '06

16 Nov '06

Hi, I encounter an chap authorization problem using pppoe3.8, ppp 2.4.4b1 and Freeradius 1.1.3. The relevant logs are: PPP dump: Nov 15 17:43:29 localhost pppd[7486]: rcvd [LCP ConfReq id=0x2 <magic 0x1b31752> <pcomp> <accomp> <callback CBCP>] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Nov 15 17:43:29 localhost pppd[7486]: sent [LCP ConfRej id=0x2 <pcomp> <accomp> <callback CBCP>] Nov 15 17:43:29 localhost pppd[7486]: rcvd [LCP ConfReq id=0x3 <magic 0x1b31752>] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Nov 15 17:43:29 localhost pppd[7486]: sent [LCP ConfAck id=0x3 <magic 0x1b31752>] Nov 15 17:43:29 localhost pppd[7486]: sent [LCP EchoReq id=0x0 magic=0xbe000118] Nov 15 17:43:29 localhost pppd[7486]: sent [CHAP Challenge id=0x2 <dd114655881b93c9111ba4122068632faa63f98d>, name = "localhost"] Nov 15 17:43:29 localhost pppd[7486]: rcvd [CHAP Response id=0x2 <3e7ffb922fcba977f3dc8c2418d7dec2>, name = "test1"] 00 00 00 00 00 00 00 00 00 00 00 00 Nov 15 17:43:29 localhost pppd[7486]: rc_avpair_new: unknown attribute 60 Nov 15 17:43:31 localhost pppd[7486]: Peer test1 failed CHAP authentication Nov 15 17:43:31 localhost pppd[7486]: sent [CHAP Failure id=0x2 ""] Nov 15 17:43:31 localhost pppd[7486]: sent [LCP TermReq id=0x2 "Authentication failed"] Nov 15 17:43:31 anton pppd[7486]: rcvd [LCP TermAck id=0x2] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ... Nov 15 17:43:31 anton pppd[7486]: Connection terminated. Nov 15 17:43:31 anton pppoe-server[7171]: Sent PADT Freeradius log rad_recv: Access-Request packet from host 127.0.0.1:32769, id=64, length=89 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "test1" CHAP-Password = 0x023e7ffb922fcba977f3dc8c2418d7dec2 Calling-Station-Id = "00:20:18:8E:6C:0E" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Processing the authorize section of radiusd.conf ..... modcall[authorize]: module "sql" returns ok for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type CHAP auth: type "CHAP" Processing the authenticate section of radiusd.conf modcall: entering group CHAP for request 1 rlm_chap: login attempt by "test1" with CHAP password rlm_chap: Using clear text password password for user test1 authentication. rlm_chap: Pasword check failed modcall[authenticate]: module "chap" returns reject for request 1 modcall: leaving group CHAP (returns reject) for request 1 auth: Failed to validate the user. Altough I can obtain authorization using: [root@localhost]# echo "User-Name = test1, CHAP-Password=password" | radclient localhost auth password Received response ID 100, code 2, length = 62 Framed-Compression = None Service-Type = Framed-User Framed-IP-Address = 193.226.57.105 Framed-IP-Netmask = 255.255.255.0 Framed-MTU = 1492 Framed-Protocol = PPP Port-Limit = 1 Do anyone encounter the same problem? I can add that chap fails with all ppp versions (>=2.4.2) Thank you, Alex

3 3

how radius server differentiates users with same name from different ip addresses
by Sri 15 Nov '06

15 Nov '06

Hi List, Pls find the following scenario: When two users Admin1 and Admin2 are trying to get authentication against freeRadius server, how FR diffentiates the two requests. Is it based on Source ip address? Sri.

1 0

Radius and Mysql
by Marilene Lima 15 Nov '06

15 Nov '06

Sr Alan DeKok, When I used radiusd -X, I got just the message: Access Denied, but the username and the passsword is correct. I use the Debian, I dont´t know if the others linux servers are different. Thanks a lot, Marilene

2 1

FR-1.1.3 on solaris10 strange things
by Alexander Serkin 15 Nov '06

15 Nov '06

Hi. We have strange behaviour on sparc solaris 10 server with fr-1.1.3 installed: without any visible reason the radiusd process goes to almost 100% CPU usage for 3-5 minutes. Then it comes back to normal state again (less than 1% CPU). Visually the 100% CPU load does not impact the system funcionality - there are no problems with authentication/accounting processing. The server is not hard loaded - there are not more than 2-3 requests per second on it. prstat output reports: PID USERNAME SIZE RSS STATE PRI NICE TIME CPU PROCESS/NLWP 757 radius 93M 10M run 40 0 0:56:05 99% radiusd/18 and "prstat -vm" : PID USERNAME USR SYS TRP TFL DFL LCK SLP LAT VCX ICX SCL SIG PROCESS/NLWP 757 radius 4.5 1.1 0.0 0.0 0.0 93 0.2 1.6 65 315 .24 0 radiusd/18 has anybody seen this? What can be the reason? Previously it was run on Netra-1120 with solaris 9, the subject appeared after moving to netra-240 Sol10: 5.10 Generic sun4u sparc SUNW,Netra-240 -- Alexander

3 9

prepaid accounting
by Engin Deveci 15 Nov '06

15 Nov '06

Hi, I need to find a solution for my one-time event based accounting problem. I have users which buy prepaid cards and use them to add credit to their web accounts. User download videos later using their credits. I'm asked to use radius for authentication and accounting. I couldn't figure out how I can do this with freeradius. Is it doable with freeradius? If not, please show me the way to do this. Regards, Engin Deveci

1 0

PEAPv2 Server
by MURAT SEZGIN 15 Nov '06

15 Nov '06

Hi, I am trying to implement a PEAP version 2 (draft-josefsson-pppext-eap-tls-eap-10.txt) client. I was using "Odyssey Server Administration" server for PEAP v1 and EAP-TTLS. But the server does not support PEAP v2. Is there any other server softwares which support PEAP v2? Or is there any body who tried to test PEAP v2? Regards, Murat Sezgin _________________________________________________________________ Real-time chat with your friends - Free download - MSN Messenger http://messenger.msn.com/?mkt=tr

2 2

RE: freeRADIUS on Solaris 10 - x86
by Ramm-Ericson, Johannes 15 Nov '06

15 Nov '06

-----Original Message----- > Date: Tue, 7 Nov 2006 11:37:49 +0100 (CET) > From: "Michael Messner" <michael.messner_edv(a)inode.at> > Subject: freeRADIUS on Solaris 10 - x86 > To: <freeradius-users(a)lists.freeradius.org> > Message-ID: <141.201.70.172.1162895869.wm(a)webmail.inode.at> > Content-Type: text/plain; charset=iso-8859-1 > > hey freeRADIUS users, > > now it looks much better: > > configure: WARNING: silently not building rlm_counter. > configure: WARNING: FAILURE: rlm_counter requires: libgdbm. > configure: WARNING: silently not building rlm_ippool. > configure: WARNING: FAILURE: rlm_ippool requires: libgdbm. > configure: WARNING: the comm_err library isn't found! > configure: WARNING: silently not building rlm_krb5. > configure: WARNING: FAILURE: rlm_krb5 requires: krb5. > configure: WARNING: silently not building rlm_ldap. > configure: WARNING: FAILURE: rlm_ldap requires: libldap_r. > configure: WARNING: iodbc headers not found. Use --with-iodbc-include-dir=<path>. > configure: WARNING: sql submodule 'iodbc' disabled > configure: WARNING: oracle headers not found. Use --with-oracle-home-dir=<path>. > configure: WARNING: sql submodule 'oracle' disabled > configure: WARNING: unixODBC headers not found. Use --with-unixodbc-include-dir=<path>. > configure: WARNING: sql submodule 'unixodbc' disabled > > I think that I need the ldap module für the active directory request, do I also need the krb5 module? > > ca mIke If you plan to authenticate against Active Directory then, yes, you _probably_ need the krb5 module. However, if you are using (for example) Quests VAS - vintela authentication system, you can authenticate against the Unix backend and don't need to compile kerberos and LDAP support. It's all a question of how you plan to set up and use your environment. Regards, JRE PS. Also, with your current configuration there are several components that you will not be ablu to use (IP Pools, Oracle SQL connectors....).

2 1

Adding queries to sql.conf and/or radiusd.conf
by Michelle Manning 15 Nov '06

15 Nov '06

Hi, I am looking to set radcheck.activeDate and radcheck.activated when a user logs in for the first time. At this same time I want to update or insert an expiration attribute for that user. I tried putting an update in the sql.conf file for the radcheck table with the queries that insert &/or update radacct. Of course it didn't work. How can I add more queries to this area and how do I let Radius know that these queries have to run at specific times like accounting_start_query and accounting_update_query. I also tried concatenation of two queries but that didn't work either. Has anyone tried this before? Any ideas for me? I also thought about putting it in radiusd.conf file. Not sure where to start there. Thanks much. Michelle Running freeRadius 1.1.3

1 0