November 2006 - Freeradius-Users - lists.freeradius.org

Unable to authenticate freeradius using PostgreSQL
by Ross McOwat 28 Nov '06

28 Nov '06

Hello all, I'm running freeradius-1.0.1-3.RHEL4, and trying to authenticate using postgresql-7.4.8-1.RHEL4.1. My freeradius daemon loads with no problems, and everything appears ready-to-go. However I cannot authenticate against data stored in my Postgres database. My database is setup as follows: radius=# select * from radcheck; id | username | attribute | value | op ----+-----------+---------------+-----------+---- 1 | ROSStest3 | User-Password | bdwnlc274 | == 2 | ROSStest4 | User-Password | nntlpa401 | == (2 rows) radius=# select * from radreply; id | username | attribute | value | op ----+-----------+-------------------+---------------+---- 1 | ROSStest3 | Framed-IP-Address | 10.150.19.134 | := 2 | ROSStest4 | Framed-IP-Address | 10.150.19.134 | := (2 rows) radius=# select * from usergroup; id | username | groupname ----+-----------+----------- 1 | ROSStest3 | static 2 | ROSStest4 | static (2 rows) Other tables are empty. Running freeradius in debug mode, the following output is given when attempting an authentication request using NTRadPing: rad_recv: Access-Request packet from host <my ip address>:1859, id=28, length=49 User-Name = "ROSStest4" User-Password = "nntlpa401" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "ROSStest4", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched DEFAULT at 156 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'ROSStest4' rlm_sql (sql): sql_set_user escaped user --> 'ROSStest4' radius_xlat: '' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): SQL query error; rejecting user rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns fail for request 0 modcall: group authorize returns fail for request 0 Finished request 0 I'm running a trace against my database, and no output is given when attempting a radius query, so I'm assuming that freeradius is not even reaching the database. The error... rlm_sql (sql): SQL query error; rejecting user ...would seem to confirm this. However I'm not sure what part of the configuration files I need to change to rectify this. At a guess, I would say it's the following line in postgresql.conf: sql_user_name = "%{User-Name}" I've tried all sorts of entries in here, without success. Any assistance would be appreciated - apologies for the long entry above! Ross McOwat

3 2

Radius attributes and APs
by Manuel Sánchez Cuenca 28 Nov '06

28 Nov '06

Can anybody tell me any Access Point which understand and enforce some radius attributes returned by freeradius, such as Session-Timeout. Thanks in advance. -- ----------------------------- Manuel Sanchez Cuenca Departamento de Ingenieria de la Informacion y las Comunicaciones Facultad de Informatica. Universidad de Murcia Campus de Espinardo - 30080 Murcia (SPAIN) Tel.: +34-968-364644 Fax: +34-968-364151 email: msc(a)dif.um.es | manuelsc(a)um.es url: http://libra.inf.um.es/~lolo

5 8

Problem with pam_radius_auth
by Maurizio Pederneschi 28 Nov '06

28 Nov '06

Hi, I'm testing Freeradius in order to autenticate squid user trough PAM module. My architecture is: SQUID SERVER --> PAM_AUTH_RADIUS --> FREERADIUS --> SQL DB All work fine but frequently in /var/log/messages I see this message: Safesquid: pam_radius_auth: radius server 212.80.192.120 failed to response Safesquid: pam_radius_auth: All radius servers failed to response What can I check to solve this problem? Thank's, Maury76

2 1

Expiration
by Sean 28 Nov '06

28 Nov '06

Hi, Just a quick question. Is expiration := Never valid in radcheck? At the moment I set dates a few years into the future for accounts that I don't want to expire, but I'm sure that they'll come back to haunt me later. Regards, Sean Bracken

3 3

Ldap attributes
by "Jóhann B. Guðmundsson" 28 Nov '06

28 Nov '06

I was wondering what is the proper way to enable ldap attributes in radius.conf for example Ldap-Group groupmembership_attribute = radiusGroupName will then other ldap attributes be matched in the same way? Ldap-Callingstationid callingstationid_attribute = radiusCallingStationId Ldap-Realm realm_attribute = radiusRealm etc etc.... Cant seem to find any documentaition about this! Maybe a chapther in your book Alan :) Best regards Johann B.

2 1

rlm_eap: SSL error
by Bruno Costacurta 27 Nov '06

27 Nov '06

Hello, I receive the following errors : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) .. Error: Trying to look up name of unknown client 127.0.0.1. .. (please see hereafter more complete log) I'm confused by the fact that this config was working fine few days. Apparently only an upgrade of linux distribution (Fedora 5-->6) was made since last succesful login. Thanks for any clue / idea. Cheers, Bruno ... Info: rlm_eap_tls: Loading the certificate file as a chain Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Info: rlm_sql (sql): Attempting to connect to root@localhost:/radius Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Info: Ready to process requests. Error: TLS_accept:error in SSLv3 read client certificate A Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Info: rlm_eap_md5: Issuing Challenge Error: Trying to look up name of unknown client 127.0.0.1. Auth: Login OK: [acer9100/<no User-Password attribute>] (from client UNKNOWN-CLIENT port 0) Auth: Login OK: [acer9100/<no User-Password attribute>] (from client Olitec402SG port 1 cli 00-12-F0-21-1A-B6) ... -- Register Linux User 353844 http://counter.li.org/ --

1 0

RE: Radius Help
by Darrell Fuquay 27 Nov '06

27 Nov '06

Christopher, Thanks for the response. We can monitor the connections using netstat on the Oracle port, but I'm not sure that is what you mean. Darrell -----Original Message----- From: Christopher Carver [mailto:ccarver0@gmail.com] Sent: Monday, November 27, 2006 10:11 AM To: dfuquay(a)hbfgroup.com; FreeRadius users mailing list Subject: Re: Radius Help When you monitor network activity on the server that runs the oracle DB are the connection requests being received? Christopher Carver ----- Original Message ----- From: Darrell Fuquay <mailto:dfuquay@hbfgroup.com> To: freeradius-users(a)lists.freeradius.org Cc: thall(a)hbfgroup.com Sent: Monday, November 27, 2006 10:32 AM Subject: Radius Help We are having trouble getting our radius server to connect to Oracle. It was connected last week and we stopped the process due to excessive database connections (an unrelated application issue) and now when we attempt to start it the last logged statement is "rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_oracle #0". Any ideas on how to see what's hanging up at this point? The database is on a remote server but I can ping that server with the host name used in the radius configuration. Thanks, Darrell _____ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Radius Help
by Darrell Fuquay 27 Nov '06

27 Nov '06

We are having trouble getting our radius server to connect to Oracle. It was connected last week and we stopped the process due to excessive database connections (an unrelated application issue) and now when we attempt to start it the last logged statement is "rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_oracle #0". Any ideas on how to see what's hanging up at this point? The database is on a remote server but I can ping that server with the host name used in the radius configuration. Thanks, Darrell

1 0

very long regular expression...
by Norbert Grochal 27 Nov '06

27 Nov '06

I have FreeRADIUS Version 1.1.0 I want to disallow login to access points for every hosts that are not in my network. So at the end of /usr/local/etc/raddb/users file I put regular expression that checks if Calling-Station-Id IS NOT in list of my hosts... DEFAULT Auth-Type := REJECT, Calling-Station-Id !~ "008012323244|002938475473|<and many other macs...>" but it is about 2300 chars in one line and my freeradius says: /usr/local/etc/raddb/users[330]: Parse error (check) for entry DEFAULT: Expected end of line or comma Errors reading /usr/local/etc/raddb/users radiusd.conf[1050]: files: Module instantiation failed. radiusd.conf[1796] Unknown module "files". radiusd.conf[1730] Failed to parse authorize section. how long can be regular expression and is there any other way to solve this problem? Norboro

5 10

Using the attrs concept but filtering it on incoming attributes?
by Jarrod Sayers 27 Nov '06

27 Nov '06

I have tried to Google this and and have come up with nothing thus far so I am going to throw this one out there to see if anyone can shed some light on this unique problem. I look after a number of FreeRADIUS 1.1.3 hosts basically acting as big proxies. One of the destination realms, in this example some.fake.realm.com.au and NULL, returns Tunnel-Private-Group-Id:1 that I trust for our access points, but when the request is proxied off to another authenticator, we strip that attribute and inject it in the post-proxy phase - all standard stuff there. I have hit a snag that is that while I trust Tunnel-Private-Group-Id: 1 from those two realms (which are the same realm really), I need that attribute stripped off when the requests are coming from other clients. Ideally I need those two top realms in my attrs file to only be processed from particular clients, but according to attrs.sample you can't add filters to the line containing the realm. The long and the short of it is that this realm is backed onto a Cisco Secure ACS server that uses Network Access Profiles to simply not return those attributes when the NAS-Identifier is not set ones I know about but it appears not to be applying the profile anymore (patch or something, I don't know...) so I would like to shift that responsibility to FreeRADIUS. Below is a conceptual example of what I am trying to achieve: >>> some.fake.realm.com.au NAS-Identifier == "SOME-AP-123" Tunnel-Private-Group-Id:1 =* ANY, Fall-Through = Yes NULL NAS-Identifier == "SOME-AP-123" Tunnel-Private-Group-Id:1 =* ANY, Fall-Through = Yes DEFAULT Tunnel-Type:1 == VLAN, ... <<< The current attrs file: >>> some.fake.realm.com.au Tunnel-Private-Group-Id:1 =* ANY, Fall-Through = Yes NULL Tunnel-Private-Group-Id:1 =* ANY, Fall-Through = Yes DEFAULT Tunnel-Type:1 == VLAN, Tunnel-Medium-Type:1 == IEEE-802, Framed-IP-Address == 255.255.255.255, Proxy-State =* ANY, State =* ANY, EAP-Message =* ANY, MS-MPPE-Send-Key =* ANY, MS-MPPE-Recv-Key =* ANY, Reply-Message =* ANY, Cisco-AVPair =* ANY, Session-Timeout > 0, Class =* ANY, Message-Authenticator =* ANY <<< Anyone with a crazy idea that might work? Jarrod.

1 0