February 2006 - Freeradius-Users - lists.freeradius.org

freeradius 1.1.0 and mysql5
by Seferovic Edvin 26 Feb '06

26 Feb '06

Hello, are there any known issues when installing freeradius with mysql support? I have Suse 9.1 with mysql5 ( from RPMs ) and after compiling freeradius - rlm_sql module is not able to link rlm_sql_myql because I do NOT have libmysqlclient.so.12 !! Sun Feb 26 17:36:24 2006 : Error: rlm_sql (sql): Could not link driver rlm_sql_mysql: libmysqlclient.so.12: cannot open shared objey Sun Feb 26 17:36:24 2006 : Error: rlm_sql (sql): Make sure it (and all its dependent libraries!) are in the search path of your sys. Sun Feb 26 17:36:24 2006 : Error: radiusd.conf[14]: sql: Module instantiation failed. Sun Feb 26 17:36:24 2006 : Error: radiusd.conf[1257] Unknown module "sql". Sun Feb 26 17:36:24 2006 : Error: radiusd.conf[1243] Failed to parse accounting section. YES - I have tried to compile with -disable-shared, but then I get a lot of other error messages about DynaLoader and rlm_smb??? extracting global C symbols from `../modules/rlm_sql/drivers/rlm_sql_mysql/.libs/rlm_sql_mysql.a' (cd .libs && gcc -c -fno-builtin -fno-rtti -fno-exceptions "radiusdS.c") cc1: warning: "-fno-rtti" is valid for C++ but not for C/ObjC rm -f .libs/radiusdS.c .libs/radiusd.nm .libs/radiusd.nmS .libs/radiusd.nmT gcc .libs/radiusdS.o -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG -I../include -DHt ../modules/rlm_perl/.libs/rlm_perl.a(rlm_perl.o)(.text+0x26fb): In function `xs_init': /root/software/freeradius-1.1.0/src/modules/rlm_perl/rlm_perl.c:613: undefined reference to `boot_DynaLoader' ../modules/rlm_smb/.libs/rlm_smb.a(smbencrypt.o)(.text+0x172): In function `E_md4hash': /root/software/freeradius-1.1.0/src/modules/rlm_smb/smbencrypt.c:107: undefined reference to `mdfour' collect2: ld returned 1 exit status rm -f .libs/radiusdS.o gmake[4]: *** [radiusd] Error 1 gmake[4]: Leaving directory `/root/software/freeradius-1.1.0/src/main' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/root/software/freeradius-1.1.0/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/root/software/freeradius-1.1.0/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/root/software/freeradius-1.1.0' make: *** [all] Error 2 Is there any way I can disable those modules I do not need ( or plan to use )? Any ideas how I can solve those problems? Thank you in advance. Regards, Edvin Seferovic

2 1

Please HELP!!! Any ideas??? MySQL and users file... Difference???
by Alex Savguira 26 Feb '06

26 Feb '06

Hi, Alan! Thanks for answering... First of all I never intended to use CRYPT passwords for MS-CHAPv2. C'mon, I know that much about MS-CHAP. ;-) Not all my users need access to new services, as I wrote, I was planning to expose the cleartext password for those who need (perhaps NT-Password in the future) and to continue using CRYPT for those who do not need the new services. If you say SQL doesn't like having two passwords in radcheck and only grabs the first one - let it be... What I wrote about hacking the code was about trying to fix this perhaps, shouldn't SQL take all check records found?... Actually I've found my around the problem... I've made a second instance of pap using clear text passwords in radiusd and I'll only change password attributes to clear text in radcheck to those who use MS-CHAP as well (placing them into group which does Auth-Type := papplain). This however leaves me without NT-Password (which is NT-Hash). An ideal situation for me would be something like this in radcheck: username | att | op | val --------------+-------------------------+----+----------- btest | NT-Password | == | NT-hashbla-bla-bla^&&@0-3443 btest | Crypt-Password | == | $1$KyUhHIHD$R7mAm4rPX1q4WTEJY5rKQ1 This however will not work because PAP burps on Crypt-Password this way. Here is the dump of having both, it was stupid of me not to include one, I admit: btest User-Password == Master1 btest Crypt-Password == "$1$KyUhHIHD$R7mAm4rPX1q4WTEJY5rKQ1" Authentication PAP Ready to process requests. rad_recv: Access-Request packet from host 192.168.0.8:1248, id=5, length=45 User-Name = "btest" User-Password = "Master1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_realm: No '@' in User-Name = "btest", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 users: Matched entry btest at line 69 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'btest' rlm_sql (sql): sql_set_user escaped user --> 'btest' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'btest' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): User btest not found in radcheck radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'btest' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'btest' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): User btest not found in radgroupcheck rlm_sql (sql): User not found rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns notfound for request 0 modcall[authorize]: module "domainmschap" returns noop for request 0 modcall: group authorize returns ok for request 0 auth: type Local auth: user supplied User-Password matches local User-Password Login OK: [btest] (from client rasdata port 0) Sending Access-Accept of id 5 to 192.168.0.8:1248 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --------------------------------------------------------------------------------------------------------- Authentication CHAP rad_recv: Access-Request packet from host 192.168.0.8:1271, id=11, length=46 User-Name = "btest" CHAP-Password = 0xd2bf262017f2f6812bc00cbd077aed9b55 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_realm: No '@' in User-Name = "btest", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 users: Matched entry btest at line 69 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'btest' rlm_sql (sql): sql_set_user escaped user --> 'btest' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'btest' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): User btest not found in radcheck radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'btest' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'btest' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): User btest not found in radgroupcheck rlm_sql (sql): User not found rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns notfound for request 0 modcall[authorize]: module "domainmschap" returns noop for request 0 modcall: group authorize returns ok for request 0 auth: type Local auth: user supplied CHAP-Password matches local User-Password Login OK: [btest] (from client rasdata port 0) Sending Access-Accept of id 11 to 192.168.0.8:1271 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds...

2 1

RE: FreeBSD 6.0 and mysql
by Rob Parker 26 Feb '06

26 Feb '06

Not sure if this is any use, but the last time I saw an error like that was with a box which had conflicting threading libraries on it... in the end I just pulled the box down and reinstalled freebsd (box was not in production, thankfully!), but this might be useful to you (it's from a KDE mailing list, but the problem/solution should be the same): http://freebsd.kde.org/pipermail/kde-freebsd/2004-August/008692.html Maybe FreeRADIUS is linked against one library and MySQL is linked to another. Cheers, Rob. -----Original Message----- From: Alan Craig [mailto:alan@mexcom.co.za] Sent: 24 February 2006 10:03 To: freeradius-users(a)lists.freeradius.org Subject: RE: FreeBSD 6.0 and mysql Nope this doesn't help. I have a suspicion it is a threading problem, but I haven't a clue on where to look to sort that out. -- View this message in context: http://www.nabble.com/FreeBSD-6.0-and-mysql-t1168311.html#a3105556 Sent from the FreeRadius - User forum at Nabble.com. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Freeradius + Microsoft Active Directory
by Natalia Escalera 25 Feb '06

25 Feb '06

Hello, I am setting up freeradius with Microsoft Active Directory. So far, I am able to connect to the server but not to authenticate a user. Can you please give me a hint of how the configuration files need to be set in order to authenticate the user. Also, what is "3D" used for? (Example: server =3D your.ad.server.org ...) Thank you in advance, Nataly

2 7

Adding A
by squirrel＠isot.com 25 Feb '06

25 Feb '06

I'm trying to add "Ascend-Data-Filter" to mysql using either phpmyadmin or dialup administrator, but it doesn't seem to work. It works fine in users text file as in: username Auth-Type := Local, User-Password == "xxx", Simultaneous-Use := 2 Service-Type = Framed-User, Framed-Protocol = MP, Ascend-Data-Filter += "ip in forward tcp est", Ascend-Data-Filter += "ip in forward dstip a.b.c.0/20", Ascend-Data-Filter += "ip in forward tcp dstport = 25", Ascend-Data-Filter += "ip in forward", Framed-Compression = Van-Jacobsen-TCP-IP But the dialup administrator allow me to add only one Ascend-Data-Filter item. If I try to add using myphpadmin ************************************** Computer problems? ................... ..............http://www.multibyte.net

2 5

Please HELP!!! Any ideas??? MySQL and users file... Difference???
by Alex Savguira 25 Feb '06

25 Feb '06

Dear Alan! > See the FAQ about pointless statements like "it doesn't work". Alan, please, you asked me to try := instead of == . I did and it does not work. Somehow I needed to inform you it did not. > Maybe you could try reading the debug output. Or failing that, >posting it here. I did in my first post. Would you please explain me, why freeradius only process one record, when it does process both while using users file? Is it possible perhaps to make the PAP module understand both CRYPT and plaintext passwords (perhaps by defining two instances of module)? I can in this case keep one record per user, and it will be cleartext for PAP and MS-CHAPv2 when the user is granted services requiring MS-CHAPv2 and CRYPT for all existing users otherwise. >Then those users can't do MS-CHAP. C'mon. This is not an answer... I can't just ignore all of my existing users and I can't make all of them to change their passwords and, as far as I know, I can't extract their passwords from the crypt hash. I really do not want to start hacking freeradius code, but on the other side I really do need to make the new services available to these users. >Stop trying to get both clear & crypted passwords to work for the >same user. Why does it work perfectly as expected when I am doing it in users file? Should not the SQL module perform the same? I am reposting the debug output here, just in case.... rad_recv: Access-Request packet from host 192.168.0.8:1061, id=7, length=45 User-Name = "atest" User-Password = "Master1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_realm: No '@' in User-Name = "atest", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 users: Matched entry DEFAULT at line 171 users: Matched entry DEFAULT at line 173 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'atest' rlm_sql (sql): sql_set_user escaped user --> 'atest' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'atest' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'atest' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'atest' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'atest' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall[authorize]: module "domainmschap" returns noop for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type PAP auth: type "PAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_pap: login attempt by "atest" with password Master1 rlm_pap: Using password "Master1" for user atest authentication. rlm_pap: Using CRYPT encryption. rlm_pap: Passwords don't match modcall[authenticate]: module "pap" returns reject for request 0 modcall: group Auth-Type returns reject for request 0 auth: Failed to validate the user. Login incorrect (rlm_pap: CRYPT password check failed): [atest/Master1] (from client rasdata port 0) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 7 to 192.168.0.8:1061 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 7 with timestamp 4400b816 Nothing to do. Sleeping until we see a request.

2 1

CentOS
by Italo Morellato 25 Feb '06

25 Feb '06

Freeradius 1.1.0 RPM for CentOS 4.2 (smeserver) is possible? Thanks in advance. Italo Morellato

3 2

Is it possible to make PAP module understand both CRYPT (MD5) and plaintext passwords?
by Alex Savguira 25 Feb '06

25 Feb '06

Dear All! I wonder is somebody has tried to make PAP understand both plaintext and crypted passwords via multiple instances for example? Would this make sense: pap { encryption_scheme = clear } pap papcrypt { encryption_scheme = crypt } in modules configuration and then Auth-Type PAP { pap papcrypt } in authenticate section? Regards Alex.

1 0

Please HELP!!! Any ideas??? MySQL and users file... Difference???
by Alex Savguira 25 Feb '06

25 Feb '06

Dear Alan! >You want to use ":=", not "==", both here and in SQL. That will >make it work. > > Alan DeKok. I've tried that already. Same result... DOES NOT work... (AND it works with both == and := when I use users file instead)... With SQL it produces the very same debugging output with both == and := A bug perhaps? Shouldn't users file and radchek table perform the very same way? As for your offer for storing the clear-text for PAP it is not an option for me, since I already have 450 users stored in CRYPT form (for a simple reason of preventing the administration power abuse as much as possible - yes that is, I do not want admin to know and use user passwords). I hate using the clear text passwords for MS-CHAPv2 as well, but I haven't yet figured out how to generete NT-hash for storing the NT-Password instead. Changing passwords for 450 users is a pain, which I want to avoid... By the way, how does one generate this hash? I am running heavily modified by me version of dialup-admin, and I haven't yet implemented the CRYPT function for NT-Hash.

2 1

Re: Freeradius + Microsoft Active Directory
by Kai Geek 25 Feb '06

25 Feb '06

Hello, your password crypt key is used. not become in this ethereal can't recognize. > Auth-Type CHAP { > chap > } > > > Auth-Type MS-CHAP { > mschap > } you must show the full and state this in the file #ls /etc/raddact #vi radius.conf #vi clients.conf best regards, -- Ozgur Karatas CCNA & Network Engineer Linux System Administrator ozgur (at) ozgurkaratas dot com > ----- Original Message ----- > From: "Natalia Escalera" <nescalera(a)gmail.com> > To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> > Subject: Re: Freeradius + Microsoft Active Directory > Date: Sat, 25 Feb 2006 11:53:20 -0600 > > > Hello Mr. DeKok > > Thank you for the fast response. The password is clear-text. We are > using ethereal to debug why we are getting "Operations Error" on the > Search Result. The Operation Errors comment is the following: > "In order to perform this operation a successful bind must be completed." > > The search request on ethereal from Freeradius to the active directory > gives the following: > Message Type: Search Request > Message Length: 96 > Response In: 469 > Base DN: dc=test, dc=prt > Scope: subtree (0x02) > Derefence: Never (0x00) > Size Limit: 0 > Time Limit: 4 > Attributes only: False > Filter: (&(objectclass=person)(sAMAccountName=%u)) > Attribute: uid ????we are not sending this attribute and we do not > know where it is specified on Freeradius > > Here are the settings given for LDAP module on radius.conf and user file: > > #radius.conf > ldap { > server="xxx.xx.xxx.xxx" > > identity ="" # If this is suppose to be the bind dn??? > > password = "mypassword" > basedn ="dc=test,dc=prt" > > #filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" > filter ="(&(objectclass=person) (sAMAccountName=%u))" > > # set this to 'yes' to use TLS encrypted connections > # to the LDAP database by using the StartTLS extended > # operation. > # The StartTLS operation is supposed to be used with normal > # ldap connections instead of using ldaps (port 689) connections > start_tls = no > > # tls_cacertfile = /path/to/cacert.pem > # tls_cacertdir = /path/to/ca/dir/ > # tls_certfile = /path/to/radius.crt > # tls_keyfile = /path/to/radius.key > # tls_randfile = /path/to/rnd > # tls_require_cert = "demand" > > # default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA" > # profile_attribute = "radiusProfileDn" > access_attr = "dialupAccess" > > # Mapping of RADIUS dictionary attributes to LDAP > # directory attributes. > dictionary_mapping = ${raddbdir}/ldap.attrmap > > ldap_connections_number = 5 > > > timeout =5 > timelimit =4 > net_timeout =2 > compare_check_items = yes > > } > > authenticate { > > Auth-Type PAP { > pap > } > > > Auth-Type CHAP { > chap > } > > > Auth-Type MS-CHAP { > mschap > } > > > unix > > > > Auth-Type LDAP { > ldap > } > > > eap > } > > #users file > DEFAULT Auth-Type := LDAP > Fall-Through = 1 > > Can you please tell us if there is something wrong or if we are > missing something on the configuration files? > > Thanks in advance, > Nataly > > On 2/25/06, Alan DeKok <aland(a)ox.org> wrote: > > "Natalia Escalera" <nescalera(a)gmail.com> wrote: > > > I am setting up freeradius with Microsoft Active Directory. So far, I > > > am able to connect to the server but not to authenticate a user. Can > > > you please give me a hint of how the configuration files need to be > > > set in order to authenticate the user. > > > > If the RADIUS packets have clear-text passwords, then the normal > > LDAP module should work. If you're using PEAP or MS-CHAP, read > > "radiusd.conf",m and use "ntlm_auth". > > > > > Also, what is "3D" used for? (Example: server =3D your.ad.server.org ...) > > > > Nothing. It's an artifact of stupid mailers. 3D is ASCII for '='. > > > > Alan DeKok. > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > +-+-+-+ BEGIN PGP SIGNATURE +-+-+-+ Version: GnuPG v1.4.2 (GNU/Linux) .-. .-. _ : : : : :_; .-' : .--. : `-. .-. .--. ,-.,-. ' .; :' '_.'' .; :: :' .; ; : ,. : `.__.'`.__.'`.__.':_;`.__,_;:_;:_; Kai "Ozgur" Geek Network Engineer PGP ID: B1B63B6E +-+-+-+ END PGP SIGNATURE +-+-+-+ -- _______________________________________________ Check out the latest SMS services @ http://www.linuxmail.org This allows you to send and receive SMS through your mailbox. Powered by Outblaze

1 0