November 2006 - Freeradius-Users - lists.freeradius.org

Help please, /var/run/freeradius/freeradius.pid: No such file or directory?
by Cameron Cowie 04 Nov '06

04 Nov '06

Hi: I am trying to setup freeradius on the latest stable version of Ubuntu. Version ... root@XXXXXXX:/sbin# freeradius -v freeradius: FreeRADIUS Version 1.0.2, for host , built on Aug 6 2006 at 20:11:24 Copyright (C) 2000-2003 The FreeRADIUS server project. When I run freeradius -x I get an output error of .... Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded System Module: Instantiated unix (unix) Module: Loaded eap rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap rlm_eap: Loaded and initialized type gtc rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess Module: Instantiated preprocess (preprocess) Module: Loaded realm Module: Instantiated realm (suffix) Module: Loaded files Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id Module: Instantiated acct_unique (acct_unique) Module: Loaded detail Module: Instantiated detail (detail) Module: Loaded radutmp Module: Instantiated radutmp (radutmp) Failed creating PID file /var/run/freeradius/freeradius.pid: No such file or directory how to I create that pid file? We are trying to keep this simple as possible, with just a plain text access list. Any help or comments will be greatly appreciated Thanks Cameron

3 2

EAP and NIS
by Pedro Henrique Morsch Mazzoni 04 Nov '06

04 Nov '06

Is there a way to use NIS to authenticate users with their passwords when I am using EAP-TLS? Thanks, Pedro Mazzoni

2 1

Best practices for redundant servers
by Aaron Paetznick 04 Nov '06

04 Nov '06

I've been struggling with this problem for a couple of weeks, and I thought I'd pass it along to the mailing list. Basically I'm trying to answer the following question. Given multiple identical dedicated servers each running Linux and MySQL, how can I configure FreeRADIUS for maximum stability, reliability, and performance? The question, it seems, is not as easy as is sounds. I have experience with running a single FreeRADIUS/MySQL server, and the configuration works well. So to move to multiple servers, I started by reading docs/configurable_failover and docs/load-balance.txt. As I was looking for both load-balancing and redundancy, I thought redundant-load-balance seemed like a slam-dunk. The idea was to have each instance of FreeRADIUS be redundant for each other, and for each instance of the MySQL back end to do the same. Therefore, I simply defined a redundant-load-balance block in each place in radiusd.conf where I had previously defined the sql module on each server. This worked for the most part, but now I'm starting to discover accounting issues. Some sessions will be recorded in both databases with the same AcctSessionId and AcctUniqueId, but with different AcctStopTimes. This seemed confusing to me, but given my shoot-from-the-hip first try at a redundant load-balancing configuration, I wasn't surprised to find problems. I looked around and couldn't find any "best practice" example config files or HOWTOs for this situation. That's when I decided to email the mailing list. So my question again, in short, is what would be the preferred method to configure FreeRADIUS/MySQL on multiple redundant servers? Any advise would be very helpful. Thanks. --Aaron

2 1

NAS and subnets
by Mike May 03 Nov '06

03 Nov '06

Hello everyone, is it possible to have NAS entries for a subnet, if so could someone give me an example Thank you

2 1

Accounting-Response
by Vasea Marii 03 Nov '06

03 Nov '06

Well i write because i still hope for a categoric answer to the previous post about sending attributes in Accounting-Response! --If possible how to set or where to find some documentation about how structures in freeradius are built! --or if it's not possible(i don't know it's tooo dificult) say so! Hope i'm not too insistent and a good day! the previous post "A week ago i was trying to find out how can i add some attributes to accounting response from a MySQL backend! Alan DeKoK showed me that the mechanism wasn't very good and that i don't send the right attributes in accounting -response! We've made some work for optimisation but found out that we still need to send some attributes meaning: when sending accounting-stop the response from FreeRADIUS should be [-Command] // ex. play 'thanks for calling through us' [-Voice-Message-Promt] specific(from sql)- [-Session-Timeout](for accounting-start response)! The mechanism is complex and we don't see other solution but adding these attributes only in Accounting-Response! I understand that should be a unique standard for this but the rfc has reserves to send attributes in accountind-response and we've created a dictionary for this purpose so it shouldn't be any problems! The problem is, as i think, that FreeRADIUS doesn't have a configurable query for accounting-response as it has for authentication-response! I tried to find in the source the place to add the stuff i need but it seems that it will take to long to understand the complex strucutre of pointers used by developers! Anyway if someone can help thanks! " --------------------------------- Cheap Talk? Check out Yahoo! Messenger's low PC-to-Phone call rates.

2 1

Re: Freeradius hangs
by Karthik R 03 Nov '06

03 Nov '06

If you had said this at the start, and posted the debug log, you would have solved the problem a long time ago. This is even in the FAQ: http://wiki.freeradius.org/FAQ#The_NAS_seems_to_ignore_the_reply_of_the_rad… Alan DeKok. Alan, As you said, I tried with the option -i : radiusd --i <ip_address_radius server> -X But still i get the below error message at the radius server end, only one NIC is active now on the server. --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.1:4754 , id=119, length=151 Sending duplicate reply to client dlink:4754 - ID: 119 Re-sending Access-Accept of id 219 to 192.168.0.1 port 4754 On the client side MSVPN dialer interface, i see the error message: "Error 718: the connection was terminated becasue the remote computer didnt respond in timely manner". Thanks for your patience and co-operation.

2 1

Bug in rlm_sql reconnect code??
by Hans-Peter Fuchs 03 Nov '06

03 Nov '06

Hello List, the following I have tested with freeradius 1.1.2 and 1.1.3 I run a radius-server as test environment. The server is connected to a mysql-database. After long idles the mysql-server drops the radius client connections. After that the reconnect fails as you can see in the following output from radiusd -X. The first packet gets a accept response, the following 2 packets get reject responses because the database queries fail. rlm_sql (AuthGuest): - sql_groupcmp radius_xlat: '000f1fcc8e87' rlm_sql (AuthGuest): sql_set_user escaped user --> '000f1fcc8e87' radius_xlat: 'SELECT GroupName FROM usergroup WHERE UserName='000f1fcc8e87'' rlm_sql (AuthGuest): Reserving sql socket id: 1 rlm_sql_mysql: query: SELECT GroupName FROM usergroup WHERE UserName='000f1fcc8e87' rlm_sql (AuthGuest): - sql_groupcmp finished: User belongs in group MAC rlm_sql (AuthGuest): Released sql socket id: 1 users: Matched entry DEFAULT at line 162 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type Accept rad_check_password: Auth-Type = Accept, accepting the user Login OK: [000f1fcc8e87] (from client noc4 port 0) Sending Access-Accept of id 10 to 134.95.129.28 port 1025 User-Name := "" Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 10 with timestamp 454aea03 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 134.95.129.28:1025, id=192, length=56 User-Name = "000f1fcc8e87" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Acct-Session-Id = "000021c0" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 rlm_sql (AuthGuest): - sql_groupcmp radius_xlat: '000f1fcc8e87' rlm_sql (AuthGuest): sql_set_user escaped user --> '000f1fcc8e87' radius_xlat: 'SELECT GroupName FROM usergroup WHERE UserName='000f1fcc8e87'' rlm_sql (AuthGuest): Reserving sql socket id: 0 rlm_sql_mysql: query: SELECT GroupName FROM usergroup WHERE UserName='000f1fcc8e87' rlm_sql_mysql: MYSQL check_error: 2006, returning SQL_DOWN rlm_sql (AuthGuest): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (AuthGuest): Connected new DB handle, #0 rlm_sql (AuthGuest): failed after re-connect rlm_sql (AuthGuest): Released sql socket id: 0 rlm_sql (AuthGuest): - sql_groupcmp finished: User does not belong in group ADMIN Invalid operator for item Sql-Group: reverting to '==' rlm_sql (AuthGuest): - sql_groupcmp radius_xlat: '000f1fcc8e87' rlm_sql (AuthGuest): sql_set_user escaped user --> '000f1fcc8e87' radius_xlat: 'SELECT GroupName FROM usergroup WHERE UserName='000f1fcc8e87'' rlm_sql (AuthGuest): Reserving sql socket id: 4 rlm_sql_mysql: query: SELECT GroupName FROM usergroup WHERE UserName='000f1fcc8e87' rlm_sql_mysql: MYSQL check_error: 2006, returning SQL_DOWN rlm_sql (AuthGuest): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (AuthGuest): Connected new DB handle, #4 rlm_sql (AuthGuest): failed after re-connect rlm_sql (AuthGuest): Released sql socket id: 4 rlm_sql (AuthGuest): - sql_groupcmp finished: User does not belong in group RZKR Invalid operator for item Sql-Group: reverting to '==' No huntgroup access: [000f1fcc8e87] (from client noc4 port 0) modcall[authorize]: module "preprocess" returns reject for request 1 modcall: leaving group authorize (returns reject) for request 1 Invalid user: [000f1fcc8e87/<no User-Password attribute>] (from client noc4 port 0) Delaying request 1 for 4 seconds Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 4 seconds... rad_recv: Access-Request packet from host 134.95.129.28:1025, id=192, length=56 Sending Access-Reject of id 192 to 134.95.129.28 port 1025 --- Walking the entire request list --- Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 192 with timestamp 454b615d Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 134.95.129.28:1025, id=87, length=56 User-Name = "000f1fcc8e87" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Acct-Session-Id = "00002657" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 rlm_sql (AuthGuest): - sql_groupcmp radius_xlat: '000f1fcc8e87' rlm_sql (AuthGuest): sql_set_user escaped user --> '000f1fcc8e87' radius_xlat: 'SELECT GroupName FROM usergroup WHERE UserName='000f1fcc8e87'' rlm_sql (AuthGuest): Reserving sql socket id: 3 rlm_sql_mysql: query: SELECT GroupName FROM usergroup WHERE UserName='000f1fcc8e87' rlm_sql_mysql: MYSQL check_error: 2006, returning SQL_DOWN rlm_sql (AuthGuest): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (AuthGuest): Connected new DB handle, #3 rlm_sql (AuthGuest): failed after re-connect rlm_sql (AuthGuest): Released sql socket id: 3 rlm_sql (AuthGuest): - sql_groupcmp finished: User does not belong in group ADMIN Invalid operator for item Sql-Group: reverting to '==' rlm_sql (AuthGuest): - sql_groupcmp radius_xlat: '000f1fcc8e87' rlm_sql (AuthGuest): sql_set_user escaped user --> '000f1fcc8e87' radius_xlat: 'SELECT GroupName FROM usergroup WHERE UserName='000f1fcc8e87'' rlm_sql (AuthGuest): Reserving sql socket id: 2 rlm_sql_mysql: query: SELECT GroupName FROM usergroup WHERE UserName='000f1fcc8e87' rlm_sql_mysql: MYSQL check_error: 2006, returning SQL_DOWN rlm_sql (AuthGuest): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (AuthGuest): Connected new DB handle, #2 rlm_sql (AuthGuest): failed after re-connect rlm_sql (AuthGuest): Released sql socket id: 2 rlm_sql (AuthGuest): - sql_groupcmp finished: User does not belong in group RZKR Invalid operator for item Sql-Group: reverting to '==' No huntgroup access: [000f1fcc8e87] (from client noc4 port 0) modcall[authorize]: module "preprocess" returns reject for request 2 modcall: leaving group authorize (returns reject) for request 2 Invalid user: [000f1fcc8e87/<no User-Password attribute>] (from client noc4 port 0) Delaying request 2 for 4 seconds Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 4 seconds... rad_recv: Access-Request packet from host 134.95.129.28:1025, id=87, length=56 Sending Access-Reject of id 87 to 134.95.129.28 port 1025 --- Walking the entire request list --- Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 2 ID 87 with timestamp 454b6165 Nothing to do. Sleeping until we see a request. Grüße Hans-Peter Fuchs Hans-Peter Fuchs - RRZK Zimmer 20 Zentrum für angewandte Informatik - Universitätsweiter Service RRZK Universität zu Köln - Tel: 0221-470-6972

1 0

Limit access to internet by mac using freeradius
by Ali Jawad 03 Nov '06

03 Nov '06

Hi Ive got a micro ISP with 50 clients running on pppoe and freeradius for authenication, each client has a username and password. When a customer dials through his winbox to create pppoe connection the pppoe server on the server loads radius.so to do the authenication. What I want to do now is the following... I want to authenicate based on mac address and i do not want to use pppoe anymore..so everybody plugging in a network cable into my switch will have immediate internet access only if I have registered his mac address for him previously, otherwise everybody plugging his network cable into my swithces will have access to my internet connection. I mean I need something like the mac address filtering used in squid ...where only registered mac address are allowed through the proxy..any hints suggestions and/or tutorials are welcome. -- With Regards Ali Jawad

4 6

RadSec
by Manuel Sánchez Cuenca 03 Nov '06

03 Nov '06

Hello all, is RadSec implemented in FreeRadius? or it is planned to be done? Thanks in advance. -- ----------------------------- Manuel Sanchez Cuenca Departamento de Ingenieria de la Informacion y las Comunicaciones Facultad de Informatica. Universidad de Murcia Campus de Espinardo - 30080 Murcia (SPAIN) Tel.: +34-968-364644 Fax: +34-968-364151 email: msc(a)dif.um.es | manuelsc(a)um.es url: http://libra.inf.um.es/~lolo

3 2

CHAP on freeradius & mysql
by John Longland 03 Nov '06

03 Nov '06

Hi all My freeradius server has been running for some time now and due to the users file getting a bit long, I decide to go with the mysql-database. I have my PAP-clients running on the new mysql-radius setup but my CHAP clients are still failing. When I was running from the users-file, an entry would look like this: DEFAULT Auth-Type = MS-CHAP, Password == "void", Calling-Station-ID == '271111111' Framed-IP-Address = 1.2.3.4 but moving to mysql, I cannot have "" as usernames. So my radcheck table has john Auth-Type MS-CHAP john User-Password john john Calling-Station-ID 271111111' When I run radiusd in debug mode, it says modcall : module sql returns ok for request 1 rlm_chap login attempt by "john" with CHAP-password rlm_chap: Using clear text password john for user john authentication rlm_chap : Password check failed Is there any othe rdebugging aids that I can switch on to see whats cooking ?? Thanks ! John

2 1